3b441577579bba146d5e53995f1eb281d32534056b2e39ce7b75fc37465c8fe2

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_c468535e7dee23d1d5bf8af4cadcfbed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 23.6MB
Sample260826-mkf7ssbr8s
SHA256 3b441577579bba146d5e53995f1eb281d32534056b2e39ce7b75fc37465c8fe2
MD5 c468535e7dee23d1d5bf8af4cadcfbed
SHA1 944c614e3d8d8f6fc6c873a97c9f6d6ef7f6e2b6
SHA512 7f0f02894bf33ee2bc1d5775c675996a11fb660d7ab8ec03eb710d114ceb702c74268d64b4917869ee14ccabafa439fc1922bf25e8df2278074ebde9299b7410
SSDEEP 49152:U+ES+ES+ES+E7+ES+ES+ES+E0+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+E7+ES+Ex:ZOU/jIEeQfoR/IuOFVjUu5o+4j0
TLSH
T1A1474B09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4DCB5B6923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4628	svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe
592	svchost_AAAACCBACAAABACAAAAABABCBBBBABAACCCCACCBAACBCCAABCAACCC.exe
5792	svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBBBAABBCCCBACCACABACAABACABAABBBCBABCBCBAABACCBABAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAACCBACAAABACAAAAABABCBBBBABAACCCCACCBAACBCCAABCAACCC.exe"	svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACBABBBBCCBCCBCAACBCCAABCABACABACAACCCABABCBBAAACBCBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe"	2026-08-25_c468535e7dee23d1d5bf8af4cadcfbed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5276	sc.exe
2660	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3324	cmd.exe
5980	cmd.exe
6088	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_c468535e7dee23d1d5bf8af4cadcfbed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAACCBACAAABACAAAAABABCBBBBABAACCCCACCBAACBCCAABCAACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4400	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3448	2026-08-25_c468535e7dee23d1d5bf8af4cadcfbed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3448	2026-08-25_c468535e7dee23d1d5bf8af4cadcfbed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3448	2026-08-25_c468535e7dee23d1d5bf8af4cadcfbed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3448	2026-08-25_c468535e7dee23d1d5bf8af4cadcfbed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4628	svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe
4628	svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe
4628	svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe
4628	svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe
592	svchost_AAAACCBACAAABACAAAAABABCBBBBABAACCCCACCBAACBCCAABCAACCC.exe
592	svchost_AAAACCBACAAABACAAAAABABCBBBBABAACCCCACCBAACBCCAABCAACCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3448	2026-08-25_c468535e7dee23d1d5bf8af4cadcfbed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4628	svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe
Token: SeDebugPrivilege	592	svchost_AAAACCBACAAABACAAAAABABCBBBBABAACCCCACCBAACBCCAABCAACCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 5980	3448	2026-08-25_c468535e7dee23d1d5bf8af4cadcfbed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 5980 wrote to memory of 4400	5980	cmd.exe	94
PID 4628 wrote to memory of 2876	4628	svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe	95
PID 3448 wrote to memory of 6088	3448	2026-08-25_c468535e7dee23d1d5bf8af4cadcfbed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	98
PID 6088 wrote to memory of 5276	6088	cmd.exe	100
PID 3448 wrote to memory of 3324	3448	2026-08-25_c468535e7dee23d1d5bf8af4cadcfbed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	101
PID 3324 wrote to memory of 2660	3324	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-25_c468535e7dee23d1d5bf8af4cadcfbed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_c468535e7dee23d1d5bf8af4cadcfbed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBCAABBCBBCACAABBBCAAAAAACBBAACAABABBCCBCCABABAABBBAABCCABBBCCBBBABCBABBACBAACBACAAACCBACACCAAABBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBCAABBCBBCACAABBBCAAAAAACBBAACAABABBCCBCCABABAABBBAABCCABBBCCBBBABCBABBACBAACBACAAACCBACACCAAABBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCACBCCBBBBBABBABCACBBAABCBACACCBCACBABAACABACCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe" start= auto displayName= "UserDataSvc_CABCACBCCBBBBBABBABCACBBAABCBACACCBCACBABAACABACCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCACBCCBBBBBABBABCACBBAABCBACACCBCACBABAACABACCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe" start= auto displayName= "UserDataSvc_CABCACBCCBBBBBABBABCACBBAABCBACACCBCACBABAACABACCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCACBCCBBBBBABBABCACBBAABCBACACCBCACBABAACABACCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCACBCCBBBBBABBABCACBBAABCBACACCBCACBABAACABACCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCBACAAABACAAAAABABCBBBBABAACCCCACCBAACBCCAABCAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCBACAAABACAAAAABABCBBBBABAACCCCACCBAACBCCAABCAACCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe
1⤵
- Executes dropped EXE
PID:5792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a21ad7a1f32b2538371a7a6acd5c044c226cb163474ab62e34815cd32db17a6a
MD5 f0a3109f562c1e5873daca1b46f3f3d6
SHA1 55c731bf6b026657e91613ea20c02284a49b4427
SHA512 43bfb69402c301cd4d2e4661c4d2476a14201a39ff63e55db5655206616d7f9455578c6dd6e07f7c0aa957d9a5ebd3f79d27cbb3210073a77f95eb3cd6b00b56
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 70732afa50a408af2345b1c97add3266d6f931ec99c61d5ed4f53095ad7c63b3
MD5 6b57ab4dcf0d6b8ec6d84b83d6705c1a
SHA1 17fbe7420a224f02bf91a193fb38e6569d23914c
SHA512 8e1d5a2e0028a47302f68a5b3daa7b7fe9bcbe778e3547b035305b2a8903776b0feff7466d688266383eeb73bccf0bcc66d4bd52c6d9ac52c894be06cf9ce805
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 491d2d342ef266f12567571f454c5c32bea82f809b06743d5591caa7498e24aa
MD5 f8ffe4afe8bfe0dc38b78690a4795f1a
SHA1 7a3147846b61069e6c4c17eba29ffeff21163d48
SHA512 17a4aa9c08b0c43cb0bc5ebb832ab4e6a571272705c6a34ddcc5046461a518eaa094e910479a43739a52fabdddae78584bc2673300bd573e672f27a258c02880
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d6be0b35766b840e8ebee5b17014468f269ec5b360d0cd2ef6c54c9b0533dee1
MD5 4a9c6d2ddf8012c86e1d14cbbac6639d
SHA1 b5e5e0849a4033375cd765b7930fa16b96ed6635
SHA512 6e62fd5efad210925b0dda3e483bce485960bb94e50d10c19dd7c39e82fa2441b738cd91e6e543f6188470acd8b63f29d0bf68a89fe3c52de3e48d481a7d2954
MD5 SHA1 SHA512

Submit Download

svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBABABBABBCCAABBBBABCBBBCAAAAABACBBAABBABABBBCCCBBAB.exe
Size 23.6MB
SHA256 3b441577579bba146d5e53995f1eb281d32534056b2e39ce7b75fc37465c8fe2
MD5 c468535e7dee23d1d5bf8af4cadcfbed
SHA1 944c614e3d8d8f6fc6c873a97c9f6d6ef7f6e2b6
SHA512 7f0f02894bf33ee2bc1d5775c675996a11fb660d7ab8ec03eb710d114ceb702c74268d64b4917869ee14ccabafa439fc1922bf25e8df2278074ebde9299b7410
SSDEEP 49152:U+ES+ES+ES+E7+ES+ES+ES+E0+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+E7+ES+Ex:ZOU/jIEeQfoR/IuOFVjUu5o+4j0
TLSH
T1A1474B09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4DCB5B6923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 51c42799aa2d25658b3d4b8cd4aafedf65f63c279df6a2e86b6e8be634ef3b29
MD5 05ea9ef6bd5ebdaa3cd1fab3388e7fd9
SHA1 1217057c494a45f7037f16626728e82dd9210a85
SHA512 9e5039b7d67c62e0126047923995b6c5d303d6701c5a181ed91ba21534bdb1edbce0ba077161c3f78ecb938dd187400c86af542e4242fff576a7c9b6049309f9
TLSH
T19F110D75D0F9D433F5333C8FA21A9D422CD63B8F5858AA28230A82197AD5874CD599F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/592-79-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/3448-0-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/3448-8-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/4628-32-0x0000000000440000-0x0000000000461000-memory.dmp

Download