ef43b4efbb9a766ff37042d92a037b47d7c131c9a669ef916dc1dd931653f237

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
Size 24.0MB
Sample260826-ptasgsdq5v
SHA256 ef43b4efbb9a766ff37042d92a037b47d7c131c9a669ef916dc1dd931653f237
MD5 b589d44a4b0aa7d2a3cef0382a91c562
SHA1 6c8d515f7f99b7f346489400c900dc0dc5c45d8d
SHA512 96bf64fd36505107fc5b042d352b2a10d75bcb452a9cdacb135720714e09e15328586112f9a2fe9b8dc48b7688889028e1a5d143e4d7b15668d2e1cf3f60a62d
SSDEEP 49152:U+ES+ES+E7+ES+ES+E7+ES+Eg+ES+E7+ES+ES+E7+ES+ES+E7+ES+Eg+ES+E7+ET:LBPp7xBPp7B+4jE
TLSH
T174472A09F94340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4DCB5B6923BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4480	svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe
3492	svchost_ABBACACAACACCCBCCBCCBAABBACCACBBBCACAAAAAAACBBACBABBBAA.exe
2364	svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBABBBACBABACBCCBCAAABCCABCBAACCACAACABAACBACAABCBBBBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe"	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBAAAABCABACACCAAACCBBBCCCCBACACCAAACCABBABAACBCAACCACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBACACAACACCCBCCBCCBAABBACCACBBBCACAAAAAAACBBACBABBBAA.exe"	svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
628	sc.exe
3040	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3760	cmd.exe
4900	cmd.exe
3352	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBACACAACACCCBCCBCCBAABBACCACBBBCACAAAAAAACBBACBABBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2716	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
2716	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
2716	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
2716	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
4480	svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe
4480	svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe
4480	svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe
4480	svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe
3492	svchost_ABBACACAACACCCBCCBCCBAABBACCACBBBCACAAAAAAACBBACBABBBAA.exe
3492	svchost_ABBACACAACACCCBCCBCCBAABBACCACBBBCACAAAAAAACBBACBABBBAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2716	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
Token: SeDebugPrivilege	4480	svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe
Token: SeDebugPrivilege	3492	svchost_ABBACACAACACCCBCCBCCBAABBACCACBBBCACAAAAAAACBBACBABBBAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1708	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 3760	2716	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe	107
PID 3760 wrote to memory of 3884	3760	cmd.exe	109
PID 4480 wrote to memory of 1860	4480	svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe	111
PID 1860 wrote to memory of 2016	1860	notepad.exe	112
PID 2716 wrote to memory of 4900	2716	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe	116
PID 4900 wrote to memory of 3040	4900	cmd.exe	118
PID 2716 wrote to memory of 3352	2716	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe	119
PID 3352 wrote to memory of 628	3352	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBCACAACAABACBBCBCACBABBCBBACCBACCBBABCBABBACBAABBBBAAABABCBACBBACBCCCCACABCABABCBAABBAACAAACCACBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBCACAACAABACBBCBCACBABBCBBACCBACCBBABCBABBACBAABBBBAAABABCBACBBACBCCCCACABCABABCBAABBAACAAACCACBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACABCABCAABBACBCBCCBAAABBCBBCABBCBBBCAAACACBABCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe" start= auto displayName= "UserDataSvc_BACABCABCAABBACBCBCCBAAABBCBBCABBCBBBCAAACACBABCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACABCABCAABBACBCBCCBAAABBCBBCABBCBBBCAAACACBABCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe" start= auto displayName= "UserDataSvc_BACABCABCAABBACBCBCCBAAABBCBBCABBCBBBCAAACACBABCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACABCABCAABBACBCBCCBAAABBCBBCABBCBBBCAAACACBABCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACABCABCAABBACBCBCCBAAABBCBBCABBCBBBCAAACACBABCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:628

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2016

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACACAACACCCBCCBCCBAABBACCACBBBCACAAAAAAACBBACBABBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACACAACACCCBCCBCCBAABBACCACBBBCACAAAAAAACBBACBABBBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe
1⤵
- Executes dropped EXE
PID:2364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 813c60da70addce9a636282c59234881fc017794870546b986dd60b263c8e1ea
MD5 43d1282aa9e4ed7b097309c58c91ee5a
SHA1 9debfdb27d731212361fed14c0ade46f3de8f620
SHA512 edc390eb53f80306ec2af41e0049b7b48a6b30079a1838dd61ca9e2f26cfad5a6886a75fb8f9d4349a7afdb21468e0ec55a1cfdad6eb7ec1df3d807d11ea7971
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cce6de1b83fd595fc9d056a0f3f4ce3cf100ea6e119395b3347c0626d2ac9249
MD5 cfd58c7b5a5904da6fda968c2ed2a0f1
SHA1 90c42557aafd94c98fa13e7aeee512615a0f3344
SHA512 4f364153bfa7e3a2f63475e1740b92ce6c8726305ed74760bcbcb0c477c54ab3921126eb665ef6629851b59bfe01e35179fa1545aa46eddd6e67decaf82bf05a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 54b9c2f15f76728c307a5e50fa94c36a1f1db1c7831d9c3705fd31b323e98bd0
MD5 cca242600f65eacc3e8f055a151f2294
SHA1 ac23d6c02093ff6809792fd24b80367926b3bc2d
SHA512 ab5100e7c1964a4f2e29a26b6de717c1a75fcb50dc9a757f3e95d2f2027f4368a07b418f8ebe263f653d3ba726f4af4fb6dc28b4e3baf204126f1d0ebaab0e56
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dad08e5d51739f740891fcec9eb04bceebdab7e3b32c1e69d01c5476f7340b0b
MD5 030b1d61850dc4b82eda75692c7635ee
SHA1 559e69606b5d8236fb12ebf7eec0c75c025b5c67
SHA512 0385a0327f51e7c00ad72e1702aeaab4864110da01030c94a35710ce52448bc03555c54aa4bdff3313a6bb43c9de461f73c6760953d713b0849d5e9f3ed34a5e
MD5 SHA1 SHA512

Submit Download

svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACBACBBBCABBCAACBBCBAACBCCCCCAACCCBBCBCBCBCAABBBCA.exe
Size 24.0MB
SHA256 ef43b4efbb9a766ff37042d92a037b47d7c131c9a669ef916dc1dd931653f237
MD5 b589d44a4b0aa7d2a3cef0382a91c562
SHA1 6c8d515f7f99b7f346489400c900dc0dc5c45d8d
SHA512 96bf64fd36505107fc5b042d352b2a10d75bcb452a9cdacb135720714e09e15328586112f9a2fe9b8dc48b7688889028e1a5d143e4d7b15668d2e1cf3f60a62d
SSDEEP 49152:U+ES+ES+E7+ES+ES+E7+ES+Eg+ES+E7+ES+ES+E7+ES+ES+E7+ES+Eg+ES+E7+ET:LBPp7xBPp7B+4jE
TLSH
T174472A09F94340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4DCB5B6923BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 e9cf609225aa8164109993e658424264d94c6d5047cb10cbd720ead9c6edb541
MD5 b082022666df06dd71f71a926a824482
SHA1 7c513fa7dfcca03701e6a6cd5373990a83348710
SHA512 d67cdac65000e07c522b5551f1c78e0618b7fdec3862dd8f21f07e87621e31af851832c732d33d4b795b2eaffaa84b04c124fb193e39855c9f606cbfbe0c68fd
TLSH
T1CE01D674E0F6AC63F93364CF56195E821CD53B7768D8BA481308821EB744C364D996D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1860-61-0x0000000005340000-0x0000000005341000-memory.dmp

Download

memory/2716-0-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/2716-8-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/3492-89-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/4480-37-0x0000000000250000-0x0000000000271000-memory.dmp

Download