cf7dd24247731fa12b9a3779056c363ad11875e7ce6ccbfb6a2bd5a6392d1359

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 20.0MB
Sample260819-esaqzsyscs
SHA256 cf7dd24247731fa12b9a3779056c363ad11875e7ce6ccbfb6a2bd5a6392d1359
MD5 d7f6da9ca184a55fffe52993b40ce7ea
SHA1 7dd654edbca14ac5414b7022afd89157ea5c619e
SHA512 cffbf10ae2b6dc0b92249abdf9da4207ec271dc13b58928d462e906b01b9a3c0c2ba3a5af700062e7c78a053ba1cfddf28d5080c5da8888f8f5ec62b0991eddf
SSDEEP 98304:/YYxYYxYYxYYxYYxYYxYYxYYJKjKWQckVgtev5mnlNLe:EKWQc0gEYnvLe
TLSH
T196275C45F94380B2D81B01B10CCBD3BF4B70BA158B129EEBF78D876EA933BD06625655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
124	svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe
5528	svchost_ACBCBCCCBBCCACBCCACABCCCCAACBCABABAABBCBCCCCBCCACCABAAA.exe
2592	svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCABCCBABCCBBCACACBCCAACBCBAABACBBBBABBBACAACCBBCABABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe"	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAACCAABACCAAAABBCCCBACCBBACBCACCCCAABABBBABABBBBBACAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCBCCCBBCCACBCCACABCCCCAACBCABABAABBCBCCCCBCCACCABAAA.exe"	svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4152	sc.exe
1500	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1508	cmd.exe
5616	cmd.exe
3536	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCBCCCBBCCACBCCACABCCCCAACBCABABAABBCBCCCCBCCACCABAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4800	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4800	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4800	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4800	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
124	svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe
124	svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe
124	svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe
124	svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	124	svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1508	4800	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	92
PID 1508 wrote to memory of 5580	1508	cmd.exe	94
PID 124 wrote to memory of 2672	124	svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe	95
PID 4800 wrote to memory of 5616	4800	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	98
PID 5616 wrote to memory of 4152	5616	cmd.exe	100
PID 4800 wrote to memory of 3536	4800	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	101
PID 3536 wrote to memory of 1500	3536	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBAAACCBBCCACBABBBCCACBACCCCCBCABBBCACBBABABABBBABCCBCCBCCAABCCBCABAACBCBBABCBAACCBBABBBAABBBBCCCCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBAAACCBBCCACBABBBCCACBACCCCCBCABBBCACBBABABABBBABCCBCCBCCAABCCBCABAACBCBBABCBAACCBBABBBAABBBBCCCCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACACABAABAACABCBCCBCACABCCBCAACCBCCBBBBBABAACCABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe" start= auto displayName= "UserDataSvc_BACACABAABAACABCBCCBCACABCCBCAACCBCCBBBBBABAACCABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACACABAABAACABCBCCBCACABCCBCAACCBCCBBBBBABAACCABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe" start= auto displayName= "UserDataSvc_BACACABAABAACABCBCCBCACABCCBCAACCBCCBBBBBABAACCABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACACABAABAACABCBCCBCACABCCBCAACCBCCBBBBBABAACCABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACACABAABAACABCBCCBCACABCCBCAACCBCCBBBBBABAACCABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:124
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2672

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCCBBCCACBCCACABCCCCAACBCABABAABBCBCCCCBCCACCABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCCBBCCACBCCACABCCCCAACBCABABAABBCBCCCCBCCACCABAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe
1⤵
- Executes dropped EXE
PID:2592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 495d63f4b39c7066b6b2efa026ab948b47136449797b7c76f36e5d3f80b8205c
MD5 7523a3980b21f4e19c66b79988e1369a
SHA1 093696812256864c01d2560962177a712c21542e
SHA512 ae429c5a2b7172b6c0f904f8a093985dadf6f201c15b4c75708805de226621b0989a10b173e2dd47386c0a1686d03a62705cb8f7b4c6dc53c46ddb97112f040e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d3c654fb12096af3e3549941fd65c9306ace39494c879a746eac7de4a66fc737
MD5 3ba8a26624545c5d1685b0886161eb2c
SHA1 00195033c49ce2d419f021a891b43d0d7527637f
SHA512 508038e1592542ebf70ca43a1f1cdd55d8fa2c36db8f02c508173f89b90e9ecd9e0ff46de5b46a355ac7bcab203d2fbfdb35022ceb30571954a66f16f63ae838
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41fee13050397e050eb0be5bfa40c6a48990f084821a575ffe95effd6e0334a0
MD5 4495047a4433eedf4ae7ad5941e28b36
SHA1 64cab267298ceb4fc4773de04fb2841cd477a23c
SHA512 115731f2e49302b61fa199b49d8d313abb9e3e98042b6e69a5a214f308ba3263455be83b3cc97a0aa8956310c47aaafdc5f6180207946c1c8bc949700d6b385e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 11a038f4f7711410d829d03369188d4e7ccbdea40bd0cd76235a4de13feda510
MD5 931645681a0eb2ffaab9e94f3c3133f7
SHA1 f8bc74a94da68e545e366dd22f89d71613b121dc
SHA512 bd7c1eb517c03d05318c785a78c337c77f43564ec70519ce575dfc4ac990defd8db8932edbf5954fa7d3bfcdb7dcd95684b284068619817bf496ed0dd6b510f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 06f7aafe4580b205b10d254e533d6433bc71860d56d2286415ec69b872d715fa
MD5 03a09fb0d23b17e344d8047a9c01b50e
SHA1 bef2d47b2e6efd4c595abf9f6c7c9f702498d0b9
SHA512 dfa6049940a300c9b402d797b0f3a21112470f9c49b0936d24532534771c9d12e70dd02883634f13b218f6ebb30bf45a6c43b36149d69a3dd3ec71a4ba418731
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4c6370290cedcc222ee4858fa9fbf006120e723cc596944799a4535e311ae9bf
MD5 5c40ec6c5d41632d74723a8446b29891
SHA1 1d7c2dd90288d54b41cdce815fedb8dcace5c23f
SHA512 e2093bdb2ef363e2a6d21dc2a72765b51caf23553a7dcfa1e162f27ae4ab047577aa496d890f8da823d8c715fd0a6238f9d5ecaafdbebd8277316bca869233c0
MD5 SHA1 SHA512

Submit Download

svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBABBCAAABACBBCAAABBACBBBCBBBBBBBAACABABAAAAAABABAAC.exe
Size 20.0MB
SHA256 cf7dd24247731fa12b9a3779056c363ad11875e7ce6ccbfb6a2bd5a6392d1359
MD5 d7f6da9ca184a55fffe52993b40ce7ea
SHA1 7dd654edbca14ac5414b7022afd89157ea5c619e
SHA512 cffbf10ae2b6dc0b92249abdf9da4207ec271dc13b58928d462e906b01b9a3c0c2ba3a5af700062e7c78a053ba1cfddf28d5080c5da8888f8f5ec62b0991eddf
SSDEEP 98304:/YYxYYxYYxYYxYYxYYxYYxYYJKjKWQckVgtev5mnlNLe:EKWQc0gEYnvLe
TLSH
T196275C45F94380B2D81B01B10CCBD3BF4B70BA158B129EEBF78D876EA933BD06625655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-34-0x0000000000150000-0x0000000000171000-memory.dmp

Download

memory/4800-0-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/4800-8-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/5528-65-0x0000000000120000-0x0000000000141000-memory.dmp

Download