99f7c081160aeef6295a5bb0f30d7559b70b8b9633be5bc2d755213971794804

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 10.7MB
Sample260828-bm6ppascmg
SHA256 99f7c081160aeef6295a5bb0f30d7559b70b8b9633be5bc2d755213971794804
MD5 f68adfcb5d7f36546e04a33cd76cfe73
SHA1 53070d4415d5b4c5d4197e6cf4e72f16bf34e7bc
SHA512 cf130bd3d54c5ffa4d4791699c1918d57865f3c40a7f230688c6763659dbd0566dd88be505413584d69699da782fe69ac78ce67410e293b2d61b9815ca0b4d5d
SSDEEP 49152:U+ES+ES+ES+Ex+ES+ES+ES+ES+ES+ES+EA+ES+ES+ES+Ex+ES+ES+ES+ES+ES+EA:bOU/jIEeQfoR/IuOFVjUu5B
TLSH
T146B64B09F94340B1D92B51B04DCBD3BF8A60BA2583224DFBFB4DCB5B6A23BE15438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1076	svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe
4256	svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe
1448	svchost_BCCABBCABBBBCCCAAABCACACAABCBABABBBACCACBABCBACCBBACBCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBABCBABCCBCBAAAABBAAACCBBCAACBAACACCBAACCBABABBBBBBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe"	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCBAAAABCCBBCCAACBCBCCCBBBBABCCACBAABBCABACBBACCCAAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCABBCABBBBCCCAAABCACACAABCBABABBBACCACBABCBACCBBACBCB.exe"	svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5680	sc.exe
5768	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1000	cmd.exe
5540	cmd.exe
2380	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCABBCABBBBCCCAAABCACACAABCBABABBBACCACBABCBACCBBACBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5804	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5804	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5804	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5804	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1076	svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe
1076	svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe
1076	svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe
1076	svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5804	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1076	svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5804 wrote to memory of 1000	5804	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	91
PID 1000 wrote to memory of 2948	1000	cmd.exe	93
PID 5804 wrote to memory of 5540	5804	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	94
PID 5540 wrote to memory of 5680	5540	cmd.exe	96
PID 5804 wrote to memory of 2380	5804	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	97
PID 2380 wrote to memory of 5768	2380	cmd.exe	99
PID 1076 wrote to memory of 5952	1076	svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABCCBCABBBCCAABABCABABBBACABBAAAABAAACCBABCCBCBAAACAACCAABBCBAABBCBBACCBBBAABBCBBBBBACCBBACACBCBCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABCCBCABBBCCAABABCABABBBACABBAAAABAAACCBABCCBCBAAACAACCAABBCBAABBCBBACCBBBAABBCBBBBBACCBBACACBCBCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCACABCCBACAACACABACBBABACACABBABABBCCCCABBABBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe" start= auto displayName= "UserDataSvc_BCCCACABCCBACAACACABACBBABACACABBABABBCCCCABBABBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5540
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCCACABCCBACAACACABACBBABACACABBABABBCCCCABBABBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe" start= auto displayName= "UserDataSvc_BCCCACABCCBACAACACABACBBABACACABBABABBCCCCABBABBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCACABCCBACAACACABACBBABACACABBABABBCCCCABBABBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCCACABCCBACAACACABACBBABACACABBABABBCCCCABBABBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe
1⤵
- Executes dropped EXE
PID:4256

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBCABBBBCCCAAABCACACAABCBABABBBACCACBABCBACCBBACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBCABBBBCCCAAABCACACAABCBABABBBACCACBABCBACCBBACBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ba5020f5dd41a9d271de286410aa8d7587bc6c8cb78f05fb8fb996595f06aeb5
MD5 5053e552155e89ae66687b34ee8c7052
SHA1 24c7417b5e6ad290eae0b37d7a0490927905cc79
SHA512 6cbedd120be799bfd93e3502e4cb469029c28dc604dc3bc48636cb8fc25c4029b4df5af2627980c31d9e2c5f2d2fec04867535187678e07b42ac5c2782b607f1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 701a66c90bcd82c2368817134a78760403972afd5123e42740554307c59d9ab7
MD5 ffb62f5bbce26d4102dfebbffbb1930d
SHA1 3ee84949c366f8679e137545275587e78074db19
SHA512 a5dcb7febe6a2b40ad1bad63b696ebc70cf89eb9d898e95fd0a29815fd67f40bf8b943aaa91709971faefe8e60e1fcc5d7595a02e95c3264d208f8ff56274df9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cbb11ffd1d14b5a9588eeec4726fd428aaffd560ef8b1b99cb172cdc25e46454
MD5 74d98a37d6c27a22703849e8a245dc31
SHA1 de9eea0cb379c6fee779cf1f4d525957cf90887c
SHA512 d43f31750c3a01a18b6f1659887ec40ac2b9802251f214a70f395d041be5d182997dfa8ed1951daa7db6635b1fd4972956e4ac7f43a65b83186652c6e68f9e8f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f4807c1bf5b56b235a21cbe2dfb91fa818cdaf51eaa768c7b173dfbc09093bb8
MD5 a8a545559c35b5d4d6706a777602aba4
SHA1 424627bb18cb37585211d3ed003ee1d80afa5a69
SHA512 e4e6d5c134ea77adcbc4abaf6cb67e07dac6a1366bbaf3f257fe5933a6ec4a4a0626b365229f083f33641c49a2c651142557b04ec4d9b86293552ee421580f51
MD5 SHA1 SHA512

Submit Download

svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBABBCBBABCCABAACCCCCBCCCBBCCCCCACCACACBACCACABABCC.exe
Size 10.7MB
SHA256 99f7c081160aeef6295a5bb0f30d7559b70b8b9633be5bc2d755213971794804
MD5 f68adfcb5d7f36546e04a33cd76cfe73
SHA1 53070d4415d5b4c5d4197e6cf4e72f16bf34e7bc
SHA512 cf130bd3d54c5ffa4d4791699c1918d57865f3c40a7f230688c6763659dbd0566dd88be505413584d69699da782fe69ac78ce67410e293b2d61b9815ca0b4d5d
SSDEEP 49152:U+ES+ES+ES+Ex+ES+ES+ES+ES+ES+ES+EA+ES+ES+ES+Ex+ES+ES+ES+ES+ES+EA:bOU/jIEeQfoR/IuOFVjUu5B
TLSH
T146B64B09F94340B1D92B51B04DCBD3BF8A60BA2583224DFBFB4DCB5B6A23BE15438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1076-23-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/1076-36-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/4256-66-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/5804-0-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download

memory/5804-7-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download