4befbaed9bbd4a1f273a060c3053d6f403bb3e214e1135d362134fc76bc7eb83

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 23:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_08a6ed0ac82e75070d30b5594d040b2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 5.8MB
Sample260827-3gn18sbc67
SHA256 4befbaed9bbd4a1f273a060c3053d6f403bb3e214e1135d362134fc76bc7eb83
MD5 08a6ed0ac82e75070d30b5594d040b2c
SHA1 e74a680840213d72848e0977431fb743ac7c4f21
SHA512 a97c34dc8efca41f3b2004655ac9ae5118b9f125dc8a1da04d9a385e1f9758b32b5cc3095c6577c1cec4e7ba34069f589547b3b5a5f947d40fbf8ff70eb2ad24
SSDEEP 49152:U+EX+EX+ElA+EX+EX+ElA+EX+EX+ElA+EX+EX+ElA+EX+EX+ElA+EX+EX+ElA+EQ:QOU/jIEeQfoR/IuOFVjUu58
TLSH
T1BA567D05F98340B1E83B11B04CDBD3BE8A70BA2586224DEBF78D871F6B32B919535756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
980	svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe
5344	svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe
5184	svchost_ABAACBCCBACBCCBCAAACAACAAABBCACCACAABBABCCABACBBCABBCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBAABABCCCBCBBBABCBBCBCCBACAACACBBBCAABBACBCCBBBCBCCBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe"	2026-08-27_08a6ed0ac82e75070d30b5594d040b2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBAACCABCCCCCCBABCAACBBBAABCBCBCCBAABABACACABBCCBABABBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAACBCCBACBCCBCAAACAACAAABBCACCACAABBABCCABACBBCABBCBA.exe"	svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2980	sc.exe
6000	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5448	cmd.exe
4788	cmd.exe
2364	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_08a6ed0ac82e75070d30b5594d040b2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAACBCCBACBCCBCAAACAACAAABBCACCACAABBABCCABACBBCABBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1468	2026-08-27_08a6ed0ac82e75070d30b5594d040b2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1468	2026-08-27_08a6ed0ac82e75070d30b5594d040b2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1468	2026-08-27_08a6ed0ac82e75070d30b5594d040b2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1468	2026-08-27_08a6ed0ac82e75070d30b5594d040b2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
980	svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe
980	svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe
980	svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe
980	svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1468	2026-08-27_08a6ed0ac82e75070d30b5594d040b2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	980	svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 5448	1468	2026-08-27_08a6ed0ac82e75070d30b5594d040b2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 5448 wrote to memory of 6060	5448	cmd.exe	94
PID 980 wrote to memory of 3948	980	svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe	95
PID 1468 wrote to memory of 4788	1468	2026-08-27_08a6ed0ac82e75070d30b5594d040b2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	96
PID 4788 wrote to memory of 2980	4788	cmd.exe	98
PID 1468 wrote to memory of 2364	1468	2026-08-27_08a6ed0ac82e75070d30b5594d040b2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	99
PID 2364 wrote to memory of 6000	2364	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-27_08a6ed0ac82e75070d30b5594d040b2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_08a6ed0ac82e75070d30b5594d040b2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBACABBCBCCBBCCAAAABCAACAAAAABBCBABACACBBAABCBCCAAABCBBBCCAAACCABCAACAABBBBABBABACBABCBCCCABACCCBCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBACABBCBCCBBCCAAAABCAACAAAAABBCBABACACBBAABCBCCAAABCBBBCCAAACCABCAACAABBBBABBABACBABCBCCCABACCCBCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBCABCACCBAAAAAABBCCCBCCABBAABCAABBBCCABBABBACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe" start= auto displayName= "UserDataSvc_BABBCABCACCBAAAAAABBCCCBCCABBAABCAABBBCCABBABBACBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABBCABCACCBAAAAAABBCCCBCCABBAABCAABBBCCABBABBACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe" start= auto displayName= "UserDataSvc_BABBCABCACCBAAAAAABBCCCBCCABBAABCAABBBCCABBABBACBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABBCABCACCBAAAAAABBCCCBCCABBAABCAABBBCCABBABBACBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABBCABCACCBAAAAAABBCCCBCCABBAABCAABBBCCABBABBACBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6000

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe
1⤵
- Executes dropped EXE
PID:5344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBCCBACBCCBCAAACAACAAABBCACCACAABBABCCABACBBCABBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBCCBACBCCBCAAACAACAAABBCACCACAABBABCCABACBBCABBCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 015016a17ed0db3051bcac122e01e6b590740f0747f19d03fbb1cf5869c04f5e
MD5 877bce69e4aaf118433022135370642f
SHA1 67fd9eb070d54ca72f1b3fe23a9337029ef26f46
SHA512 b8f1d1eb333d23fd65fda40be4ffbb8dc18a4062cf509cb377568604d27ad5838c0051352b4f36a5786396e5edf36d6d260895d68e4f8fa7e3d685e16cc42d85
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5d24458e8b2fc34aeb398c892bb1555613249f90a82491a3ac3b707378af6d08
MD5 d505cd77b602489a874a66f293936de1
SHA1 3e65a201584729f6ce9ab121bfaf629ec07ac09e
SHA512 83cba5d1b5f55803dd89fd0100e4a9134fe18bf6508c63bcd99f4011a46b84ad8dded98db1f50ebe62bfe0d95c9ca5d7b38ddbb2cf0f26f67c10c45114866218
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 97103fdbc2a0a2bcb67dc399654181c5e54a1f872a999c01abe28e9b005c1604
MD5 a5716a8150bb8517c41d18d22158da2b
SHA1 6e2b241a9245f4e3c4f7f4d767f486b3c327411a
SHA512 41f6636d684a385ddd34a9e7623525a4ec15a08b3542238654317a2108aa3aeab485579405999fdfea93f35bd6aee913b8df627f0122f5619fc62d6aeb2869d5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 77631548bd2b418052c009de7374a5d0dd548af1b1ca3bb540f1700d632f9574
MD5 15d27628ef3c883b103b76da9c9f1ada
SHA1 851e81024935c0c9d7fcd5172146448928361039
SHA512 437af08941d7d7f674881c82da1093baab04ab2e25e17c9385dfe0beff2717134a5f3f1bfbde37321d569076183f8a0cc99b7cc1b9d4baf9d7aab72ec6fa7048
MD5 SHA1 SHA512

Submit Download

svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBABBCCBAACBCBBABAACACAABCCCBCBAAACCAABCCACABAAACBBC.exe
Size 5.8MB
SHA256 4befbaed9bbd4a1f273a060c3053d6f403bb3e214e1135d362134fc76bc7eb83
MD5 08a6ed0ac82e75070d30b5594d040b2c
SHA1 e74a680840213d72848e0977431fb743ac7c4f21
SHA512 a97c34dc8efca41f3b2004655ac9ae5118b9f125dc8a1da04d9a385e1f9758b32b5cc3095c6577c1cec4e7ba34069f589547b3b5a5f947d40fbf8ff70eb2ad24
SSDEEP 49152:U+EX+EX+ElA+EX+EX+ElA+EX+EX+ElA+EX+EX+ElA+EX+EX+ElA+EX+EX+ElA+EQ:QOU/jIEeQfoR/IuOFVjUu58
TLSH
T1BA567D05F98340B1E83B11B04CDBD3BE8A70BA2586224DEBF78D871F6B32B919535756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/980-24-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/980-37-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/1468-0-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/1468-8-0x00000000007E0000-0x0000000000801000-memory.dmp

Download