b5c376c95de484ea9efd4952112d471e63eef1624e88de9de43cc7084fd9b1df

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_b920200701514a5cf6eee6313c9515f4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 21.7MB
Sample260819-e7s6wawgrb
SHA256 b5c376c95de484ea9efd4952112d471e63eef1624e88de9de43cc7084fd9b1df
MD5 b920200701514a5cf6eee6313c9515f4
SHA1 0cfc7129656bea1921765bbc1368ae05ffe3dc8c
SHA512 f83d3b211d02bbf5d477cd8d15b0b8c1e86c45af57e52667abf7d52586879f5a4b3853ff0d69fc070605c795db3f024831489c504e976beed67b4bda27cb81e5
SSDEEP 98304:HxwcxwcxwcxwcxwcxwcxwcxwsOU/jIEeQfoR/IuOFVjUu5p:pFIF0wu/
TLSH
T185375B05F94380B2D82B01714CDBD3BF4B70BA258B128AEBF74D876EAA33BD06535655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
108	svchost_ACCACCCCBCAACACCBBBCCCABABBACCABABAAAACBAAAACBABBCCABBB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACACBBBCABCCAABBCAABAACAACBABAAABABCBBACBCACAABCCCBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCACCCCBCAACACCBBBCCCABABBACCABABAAAACBAAAACBABBCCABBB.exe"	2026-08-19_b920200701514a5cf6eee6313c9515f4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1916	sc.exe
4056	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1520	cmd.exe
5560	cmd.exe
3916	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_b920200701514a5cf6eee6313c9515f4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCACCCCBCAACACCBBBCCCABABBACCABABAAAACBAAAACBABBCCABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3440	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4312	2026-08-19_b920200701514a5cf6eee6313c9515f4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4312	2026-08-19_b920200701514a5cf6eee6313c9515f4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4312	2026-08-19_b920200701514a5cf6eee6313c9515f4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4312	2026-08-19_b920200701514a5cf6eee6313c9515f4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
108	svchost_ACCACCCCBCAACACCBBBCCCABABBACCABABAAAACBAAAACBABBCCABBB.exe
108	svchost_ACCACCCCBCAACACCBBBCCCABABBACCABABAAAACBAAAACBABBCCABBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	2026-08-19_b920200701514a5cf6eee6313c9515f4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	108	svchost_ACCACCCCBCAACACCBBBCCCABABBACCABABAAAACBAAAACBABBCCABBB.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 1520	4312	2026-08-19_b920200701514a5cf6eee6313c9515f4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	91
PID 1520 wrote to memory of 3440	1520	cmd.exe	93
PID 4312 wrote to memory of 5560	4312	2026-08-19_b920200701514a5cf6eee6313c9515f4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	94
PID 5560 wrote to memory of 1916	5560	cmd.exe	96
PID 4312 wrote to memory of 3916	4312	2026-08-19_b920200701514a5cf6eee6313c9515f4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-19_b920200701514a5cf6eee6313c9515f4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_b920200701514a5cf6eee6313c9515f4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAABBBCCAABAACCBBAABBBBCBCCABAACABBCAABACBABACACCCBABCBBABABBCACACBABCBBCAACACBABACBBCBBBCABACABCCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACCCCBCAACACCBBBCCCABABBACCABABAAAACBAAAACBABBCCABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAABBBCCAABAACCBBAABBBBCBCCABAACABBCAABACBABACACCCBABCBBABABBCACACBABCBBCAACACBABACBBCBBBCABACABCCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACCCCBCAACACCBBBCCCABABBACCABABAAAACBAAAACBABBCCABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABBBAACCACBCCCCBCBBBACBCCABAACACBBAACCBCAABCBBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACCCCBCAACACCBBBCCCABABBACCABABAAAACBAAAACBABBCCABBB.exe" start= auto displayName= "UserDataSvc_BCABBBAACCACBCCCCBCBBBACBCCABAACACBBAACCBCAABCBBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABBBAACCACBCCCCBCBBBACBCCABAACACBBAACCBCAABCBBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACCCCBCAACACCBBBCCCABABBACCABABAAAACBAAAACBABBCCABBB.exe" start= auto displayName= "UserDataSvc_BCABBBAACCACBCCCCBCBBBACBCCABAACACBBAACCBCAABCBBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABBBAACCACBCCCCBCBBBACBCCABAACACBBAACCBCAABCBBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3916
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABBBAACCACBCCCCBCBBBACBCCABAACACBBAACCBCAABCBBBBA"
    3⤵
    - Launches sc.exe
    PID:4056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACCCCBCAACACCBBBCCCABABBACCABABAAAACBAAAACBABBCCABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACCCCBCAACACCBBBCCCABABBACCABABAAAACBAAAACBABBCCABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8a35dddff4199c50e677ab216ee3d801f016498b8afc98412efe6a6f7e0e98a1
MD5 e388afa00fc0176bf906ebca96bd9e9b
SHA1 03607047c13272c924fedd420027d1a040da8749
SHA512 6864f99433a98e0af2c1871e58423d38095ed0aa89f56845d52fb3c3b996967a5488e700be663f225f6e6b3beb89233ec143f31cd111bc0f3f79e39f5e75ed14
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d8a634fbcb46f3703ff94d3ae3ad3df80de25056efed64eaba141695df793e65
MD5 3d4a5b3cd94f66c7e709d23e75829e98
SHA1 aa464250b4efee5cf62f0cb91b798f96034b72d8
SHA512 d7b04ad7479283560e1687c6a6c7f5c34314d0698e9d2e49bfad483aa34397bb39baf9b4d0340fcfb7cf456251e302301ee7bd5dee2892aa42fd18b8f3179aff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7da06e2b0d0f5f0162d6ec63453dd2d28f15dd33d757b5243b635adae3cf89fe
MD5 6a8db1cb5aa6e80824e7d98cbad26448
SHA1 8ca1591697660b8bcc3984d5090d4862c8bfec29
SHA512 a78415610c7d3647c923305c38812f99860d8f9a7c7dffd3b87d3d689c23552b7492e461a43b788ca936f9cee3b47b5c582431e037b3740736df09525c64ea0a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 11eeb818a551a261d4812fa7dadf823be44ab0fa1b675c8379d186fbe49a7d8a
MD5 d5d5e9d9ea10ed38d87144aa0b8d3755
SHA1 d10421ee061708f8e646f292dcc1b4196ff7178f
SHA512 b6c00efc97de6521c4e87bc7a1f0a767e0fca0b3e960292cae594b1d55906d8febf6f81b8a807b8a3fc82984215461a45c62b7ffcc99128d973287a0be29139b
MD5 SHA1 SHA512

Submit Download

svchost_ACCACCCCBCAACACCBBBCCCABABBACCABABAAAACBAAAACBABBCCABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACCCCBCAACACCBBBCCCABABBACCABABAAAACBAAAACBABBCCABBB.exe
Size 21.7MB
SHA256 b5c376c95de484ea9efd4952112d471e63eef1624e88de9de43cc7084fd9b1df
MD5 b920200701514a5cf6eee6313c9515f4
SHA1 0cfc7129656bea1921765bbc1368ae05ffe3dc8c
SHA512 f83d3b211d02bbf5d477cd8d15b0b8c1e86c45af57e52667abf7d52586879f5a4b3853ff0d69fc070605c795db3f024831489c504e976beed67b4bda27cb81e5
SSDEEP 98304:HxwcxwcxwcxwcxwcxwcxwcxwsOU/jIEeQfoR/IuOFVjUu5p:pFIF0wu/
TLSH
T185375B05F94380B2D82B01714CDBD3BF4B70BA258B128AEBF74D876EAA33BD06535655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-25-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/108-38-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/4312-0-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/4312-8-0x0000000000870000-0x0000000000891000-memory.dmp

Download