3a5f3991c23b0a20b2b3b88c54d3f262785825ffa74232ac9619c7f8bacd96dd

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 23.4MB
Sample260827-nabd8stdmd
SHA256 3a5f3991c23b0a20b2b3b88c54d3f262785825ffa74232ac9619c7f8bacd96dd
MD5 a607f32371e2586e52362d8fc7653d0a
SHA1 39cb0f116ce34141125c18038c67ee88f6eba86e
SHA512 34ed2b64039278705d65e08266e4b166272c2a5601259fe9d32f2374b32d1838c7681f7d190e7c49106426de761096c7733186bf773c1513b90ec16f6ac06ffe
SSDEEP 49152:U+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw3:BRRRRRRZOU/jIEeQfoR/IuOFVjUu5L
TLSH
T16A374C09F6DE0465E877617049E7C27AC671B9618732CADFE288C63E5E33BD0A834B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3468	svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe
1112	svchost_BACACBABACBBACACBAABBCAAAAABABCCACCCCBBCCABABBACABBBBAC.exe
1848	svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCABAACCACBABACAACABCBBBCBACBCABACCCCCBBBCCBBBBCBCBBAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe"	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAABACACCABBBBBCCACCCABBACCCBAACCCAACCABACCCBBCAABBBCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACACBABACBBACACBAABBCAAAAABABCCACCCCBBCCABABBACABBBBAC.exe"	svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3640	sc.exe
4500	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1468	cmd.exe
2132	cmd.exe
4944	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACACBABACBBACACBAABBCAAAAABABCCACCCCBBCCABABBACABBBBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4852	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4852	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4852	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4852	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3468	svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe
3468	svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe
3468	svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe
3468	svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4852	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3468	svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3708	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 4944	4852	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	108
PID 4944 wrote to memory of 3728	4944	cmd.exe	110
PID 3468 wrote to memory of 2884	3468	svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe	112
PID 2884 wrote to memory of 1032	2884	notepad.exe	113
PID 4852 wrote to memory of 1468	4852	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	117
PID 1468 wrote to memory of 3640	1468	cmd.exe	119
PID 4852 wrote to memory of 2132	4852	2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	120
PID 2132 wrote to memory of 4500	2132	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_a607f32371e2586e52362d8fc7653d0a_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCBAAABCCCCBCABAAAABBCCAAACBBCABCCABBBAAABABCAACBABBBBACABCCCCAABABAAABBBCBBCCCBCBACCBBACABAABCBACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCBAAABCCCCBCABAAAABBCCAAACBBCABCCABBBAAABABCAACBABBBBACABCCCCAABABAAABBBCBBCCCBCBACCBBACABAABCBACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCCCBCBBBACBBCBACCCCBBAABCAABABCCBCACBACCAACABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe" start= auto displayName= "UserDataSvc_BCBCCCBCBBBACBBCBACCCCBBAABCAABABCCBCACBACCAACABBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCCCBCBBBACBBCBACCCCBBAABCAABABCCBCACBACCAACABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe" start= auto displayName= "UserDataSvc_BCBCCCBCBBBACBBCBACCCCBBAABCAABABCCBCACBACCAACABBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCCCBCBBBACBBCBACCCCBBAABCAABABCCBCACBACCAACABBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCCCBCBBBACBBCBACCCCBBAABCAABABCCBCACBACCAACABBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1032

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBABACBBACACBAABBCAAAAABABCCACCCCBBCCABABBACABBBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBABACBBACACBAABBCAAAAABABCCACCCCBBCCABABBACABBBBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1112

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe
1⤵
- Executes dropped EXE
PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 54cf446ef204fcb2f0b7ab589830460e74020298b6d65af0bb5e91cf31ec8885
MD5 c11c08c9ea5c6c0c1ecb0395ffcb197e
SHA1 2a49757447ca1c37dd450ffc02473893d8b89d73
SHA512 3014817d8d2808ba6ad49e991c40bf5129c6319bcc739b995b0637cf96ed9235b82b31b14a44b0a78afa63960f9a3411058c683f96dbde71ea794b3c9606d3c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 66c9063352fd1d53fcac40a875002d9fadfd272a31f95d27c93906422b37a38f
MD5 b4957b7fddabffd0ac0ec1ff854056a6
SHA1 61a55136d8def196abb68fac3aef01f0281374f4
SHA512 db775ee10e5705b63fecab95dc609ca46bb29583ed84da9031fc887325faf5b655b9dbe9a0b47ec74913fff82563adc7bfd60e05ec3ca4e19b4bb0f3b4828b30
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c1827fed694ddebde5ae68b8bf039d4f16d0ad8a484643c400c93f5ac4ade65a
MD5 30f97d78883e1b7545aa540b7af11b5c
SHA1 03de0f8411798dc3d7d5701f039c0bf3b8b0b580
SHA512 2bdcc8279f69b7e61b69aadaf00bacd97de80744d8d8c1e300b5539b9b154ac900d3bb08875ed4f0b198cef77d834b17d01429e0ece4d9e002b575d2f2f5232f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 46f34dce80bbe91b4bc6fdab107536975cdd1c2028e24adb9e6cc5b00ee0cc6f
MD5 f2a7ba2b9f3fd0c099bc2356e4c455b7
SHA1 b48644b4973c8f62d129c9dbb6b83328a769a683
SHA512 57ae51d592054f414d62c4c76dc05cb4672bb89fe7132bfcc08b321cd8273c8e02729e6bf8cef2c5c9fe38443627ad21ba2c26c3f6ee9ccbf7b480c2ab7fb4e1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5653312cc864bc6fa41890ce7c17fa426ad5f37b4f94fe5640fda08fec964a50
MD5 34b035d153ffe194b9fcff79cc81aa34
SHA1 31e68ba120c85fe47bf946ae10268bbd67414b35
SHA512 30ffcd78b4eb776a626ce128e6582b6a5761a5f076676cb14beab83468e85d5e7bae7173ff375987805cf394e4132b2de53d951acf9b7acca48baf52ee1d4600
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 76f88e165a43fcfdacc23b6acd8373fb302b017b406843e657bbfc0f645fafdb
MD5 15ba8cdb09363dd1b6312afee111c4d7
SHA1 c59b172f42df1131375ef90684e4900a3ecfa51d
SHA512 2498b9b901739fd617ec070bc9d1a61beab9f065097acfa971e677461b38b1543eebe9f6aff56f3bf6ddf5b48c5cb5f5a84dd2eafc93bcf4d3ace3d00de8433c
MD5 SHA1 SHA512

Submit Download

svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCBAACCCBBBCBCCACCBACBBACAACCAACBBAABBCCBCCBCACA.exe
Size 23.4MB
SHA256 3a5f3991c23b0a20b2b3b88c54d3f262785825ffa74232ac9619c7f8bacd96dd
MD5 a607f32371e2586e52362d8fc7653d0a
SHA1 39cb0f116ce34141125c18038c67ee88f6eba86e
SHA512 34ed2b64039278705d65e08266e4b166272c2a5601259fe9d32f2374b32d1838c7681f7d190e7c49106426de761096c7733186bf773c1513b90ec16f6ac06ffe
SSDEEP 49152:U+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw3:BRRRRRRZOU/jIEeQfoR/IuOFVjUu5L
TLSH
T16A374C09F6DE0465E877617049E7C27AC671B9618732CADFE288C63E5E33BD0A834B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1112-72-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/1848-83-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Download

memory/2884-59-0x0000000002C70000-0x0000000002C71000-memory.dmp

Download

memory/3468-36-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Download

memory/4852-0-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/4852-7-0x0000000000700000-0x0000000000721000-memory.dmp

Download