89cf578ba8ea1ba010c1a5ec06ca6fa28115e895e97ce1be2f82e23a4bded93e

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 7.2MB
Sample260827-ghctpsdn2v
SHA256 89cf578ba8ea1ba010c1a5ec06ca6fa28115e895e97ce1be2f82e23a4bded93e
MD5 f0b6661d2b0761355387275b7194a7a1
SHA1 330bfcb9b1911667cc02fb90fabf9ce189231cc1
SHA512 ba9815fca3e8d8b5351931b52c3932f37d84d51849f9afac1703b4761e51d4f0cad5c56f661ba1cd8129b615c89eaaa16c29347823898753c9743614e9d16c11
SSDEEP 49152:U+EDqatglRMiw2J+EDqatglRMiw2J+EDqatglRMiw2J+EDqatglRMiw2J+EDqatB:eGGGGGGGXKjKWQckVgtev5mnlNLd
TLSH
T137765A06B7DD44A1E4B7223148A782A69BB2B8515F32D7CF6384933D5E337D0AE31B52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3504	svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe
5040	svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe
2656	svchost_CBCAAACABBBBCACBBCBAAAAAAABBCBABCBAABBCCCACACAABCACACAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACBCBCBBAABCBBBCCAABAAAAABCBACACBCCBACCAABCCBBBCCBCCCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe"	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAABCABCBBAACBBBCBBCCBCABACCCCCACABBCABCABBCCABCAAABABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCAAACABBBBCACBBCBAAAAAAABBCBABCBAABBCCCACACAABCACACAC.exe"	svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2320	sc.exe
1060	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4392	cmd.exe
4744	cmd.exe
3728	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCAAACABBBBCACBBCBAAAAAAABBCBABCBAABBCCCACACAABCACACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3836	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3836	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3836	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3836	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3504	svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe
3504	svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe
3504	svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe
3504	svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3836	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	3504	svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3464	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 3728	3836	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	102
PID 3728 wrote to memory of 4912	3728	cmd.exe	105
PID 3836 wrote to memory of 4392	3836	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	109
PID 4392 wrote to memory of 2320	4392	cmd.exe	111
PID 3836 wrote to memory of 4744	3836	2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	112
PID 4744 wrote to memory of 1060	4744	cmd.exe	114
PID 3504 wrote to memory of 4076	3504	svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe	116
PID 4076 wrote to memory of 2612	4076	notepad.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f0b6661d2b0761355387275b7194a7a1_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAAAABABCBCBBBBACABBBCBBBBBBBBACACAABCBCABABAAABBBACABCCAABBACBABBBABCBBCAAACCAACBACAACCBBCBAABBABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAAAABABCBCBBBBACABBBCBBBBBBBBACACAABCBCABABAAABBBACABCCAABBACBABBBABCBBCAAACCAACBACAACCBBCBAABBABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBACBBBCCCCCCABBACCBCABCACCAACACCAABACAAACAACCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe" start= auto displayName= "UserDataSvc_BCCBACBBBCCCCCCABBACCBCABCACCAACACCAABACAAACAACCCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBACBBBCCCCCCABBACCBCABCACCAACACCAABACAAACAACCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe" start= auto displayName= "UserDataSvc_BCCBACBBBCCCCCCABBACCBCABCACCAACACCAABACAAACAACCCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBACBBBCCCCCCABBACCBCABCACCAACACCAABACAAACAACCCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBACBBBCCCCCCABBACCBCABCACCAACACCAABACAAACAACCCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe
1⤵
- Executes dropped EXE
PID:5040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACABBBBCACBBCBAAAAAAABBCBABCBAABBCCCACACAABCACACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACABBBBCACBBCBAAAAAAABBCBABCBAABBCCCACACAABCACACAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AssertLimit.exe

Path C:\Users\Admin\Desktop\AssertLimit.exe
Size 43.3MB
SHA256 afd477c48c4a1325814bab0396dd813143de850569e1fb61c6000af2b61ffbe6
MD5 ef9a30472a58dd8df0cc7e6ff03a5357
SHA1 d1197ac4182973c7cbbd286dd34dcf57be097820
SHA512 ea39c18b186d75d99a6e8182443d8f78f8331a76ff1d5070fec037412642f575bc7fd91157b43fd3718b1acf8e62d0be4ccc600f38dbcdd095f94f348830950b
SSDEEP 393216:FcZEIvHcZEIvHcZEIvHcZEIvHcZEIvHcZEIvtIlXp:0EIvaEIvaEIvaEIvaEIvaEIvtIlXp
TLSH
T19CA75B06B7DD44A1E4B7223148A782A69BB2B8515F32D7CF6384933D5E337D0AE31B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertLimit.exe

Path C:\Users\Admin\Desktop\AssertLimit.exe
Size 50.5MB
SHA256 7f7e2b9a3dfa56ed30da6614670da44d69cabad9b20d677e3dbac0b18c9eb111
MD5 3c1298fc59ee59c3f302e96bcbefae20
SHA1 27c84ff4e8a4ffccbdb7d53c6c4664e13497249f
SHA512 92f1d240554275b0c2cec83f6e59a17137e49f15d1e7c51a6b38452e7f82f737e537847135407acc27cf3f9c64c9f8a73d5bc003376c37424c63d8cce42cbac9
SSDEEP 786432:0EIvaEIvaEIvaEIvaEIvaEIvaEIvtIlXK:MmmmmmmtIlXK
TLSH
T1DEC75B06B7DD44A1E4B7223148A782A69BB2B8515F32D7CF6384933D5E337D0AE31B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eaa32e35cb58778624eed1858dabec92ab0c5a9535212e4faa7623ed2aa70bbe
MD5 71188530f7af33681ad33a96d08918b1
SHA1 9966ad16a56da3e708e3acacd0359c33cc0094fb
SHA512 727be2252e4447a0a673445490cef8cd27c8845320a3f5086056a5d29c3907fdf36cf0694d453d42159cbf9b9646e0d8bf6e20b079c5d68fd98a79ba71f29811
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a269440c10c2325cc927e49ad3ac0d0075c3b1c8b43f7b14f718ea6b7e3d2261
MD5 4cf4b5af08cd0c2bd527cc27b6696001
SHA1 eb5de89429cb4adef4ed803c3837eead21d2390b
SHA512 b70522104683b723dc229f33803e5c1c343e3d8628d28eaafb0557a762304dd4087a0b728f96ac8969be5b5369526998540bbc95fdfa011fb84e017ca750e0c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9214eab3e9c5dc6933b45ae6700baff884b69497d4183a48788c262274a2b32a
MD5 5e14bc095525917b74811209e50f1b1b
SHA1 4cacbad063cd376ba23f0591c771820bdaa703ba
SHA512 414b88b7b47f5bd90ce3c04879bbc387941aa2b9c6d89b5353937d88af1b388f6f7465703de1f85826697fe0c3f019108ffa09828c6c5569a5cb7343a64720d5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1a63ce399b9a39b1ea743eedad9851066b8624ad2ef5306e87e410858557de55
MD5 b2ac45a533d522dc8ec599de94bea0ff
SHA1 883841669a82c14f1c37c30966f61997f6d78786
SHA512 933017f88260e436cb5ff81e2436b963962c505d470681eaf11fdfc0fab21df7fa205b309e9dd9faa462ce44977cd025bb1cfb76a67ed6afd04a50d35cdf2647
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2bc20fc4f927a36625a986c05f2501a39f72903ba4a4a1ed937ba68d3d36ff5d
MD5 845d157a2cb472db5119d382b08cdfb1
SHA1 942147720341c4e1381b7a442a965bbfc3b96239
SHA512 6b7a5110d85cdb181c30ed44efad06c233b449fd015ebabfef7e3b369d77576601d3173997167c46d8575bb96167d638a1575f5e433e1a70d38dbd5f35b5326b
MD5 SHA1 SHA512

Submit Download

svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBACCBACCBCABCBAACAABCACCBAACCBABACBCCBBBCCABBCBCAAA.exe
Size 7.2MB
SHA256 89cf578ba8ea1ba010c1a5ec06ca6fa28115e895e97ce1be2f82e23a4bded93e
MD5 f0b6661d2b0761355387275b7194a7a1
SHA1 330bfcb9b1911667cc02fb90fabf9ce189231cc1
SHA512 ba9815fca3e8d8b5351931b52c3932f37d84d51849f9afac1703b4761e51d4f0cad5c56f661ba1cd8129b615c89eaaa16c29347823898753c9743614e9d16c11
SSDEEP 49152:U+EDqatglRMiw2J+EDqatglRMiw2J+EDqatglRMiw2J+EDqatglRMiw2J+EDqatB:eGGGGGGGXKjKWQckVgtev5mnlNLd
TLSH
T137765A06B7DD44A1E4B7223148A782A69BB2B8515F32D7CF6384933D5E337D0AE31B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2656-103-0x0000000000D60000-0x0000000000D81000-memory.dmp

Download

memory/3504-104-0x0000000000590000-0x00000000005B1000-memory.dmp

Download

memory/3504-35-0x0000000000590000-0x00000000005B1000-memory.dmp

Download

memory/3504-53-0x0000000000590000-0x00000000005B1000-memory.dmp

Download

memory/3504-76-0x0000000000590000-0x00000000005B1000-memory.dmp

Download

memory/3836-62-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/3836-87-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/3836-10-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/3836-36-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/3836-23-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/4076-88-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Download

memory/5040-95-0x0000000000590000-0x00000000005B1000-memory.dmp

Download