eb0ec48d80e0dfbcfefc5a79a415d896a814d3b8e8d1c8d609c4619b4c1a074d

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_f1bf0c1fdaf2fd679da3dae32c2aa7d3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 10.8MB
Sample260828-cewp7aem41
SHA256 eb0ec48d80e0dfbcfefc5a79a415d896a814d3b8e8d1c8d609c4619b4c1a074d
MD5 f1bf0c1fdaf2fd679da3dae32c2aa7d3
SHA1 5f82e28557ac955a09c69810880d5bb364481adb
SHA512 483a39f8ceaa1e93616a6b28b44c0e8acc048b4b0e4e2764a0d83daee728afd5396c9ee8aa7f87fe3628d8c8db10a352b35d69956747719e2ab2f03994668ef5
SSDEEP 49152:U+ES+EV+ES+EV+ES+EV+ES+EV+ES+EGq+ES+EV+ES+EV+ES+EV+ES+EV+ES+EGqv:AOU/jIEeQfoR/IuOFVjUu5Z
TLSH
T124B64C09F98740B1E97751B04CDBD2BF8630BA2583128DFFF64DC72BAA32B915834656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2216	svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe
3432	svchost_BCBCCCACCAAAACABACAABABBBBBBBACBACCBAABBBCBBBACBBACBBBA.exe
3652	svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBCBCBCCBAAAABCAACAABCCABBABCCBCCCABCCCCCACBCACAACCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe"	2026-08-27_f1bf0c1fdaf2fd679da3dae32c2aa7d3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABAACBACABBABBAABBBAACACBAABCAABCCCACCCBABBBBBCCBBABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCCCACCAAAACABACAABABBBBBBBACBACCBAABBBCBBBACBBACBBBA.exe"	svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5588	sc.exe
4124	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5660	cmd.exe
2712	cmd.exe
3856	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCCCACCAAAACABACAABABBBBBBBACBACCBAABBBCBBBACBBACBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_f1bf0c1fdaf2fd679da3dae32c2aa7d3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5464	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1152	2026-08-27_f1bf0c1fdaf2fd679da3dae32c2aa7d3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
1152	2026-08-27_f1bf0c1fdaf2fd679da3dae32c2aa7d3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
1152	2026-08-27_f1bf0c1fdaf2fd679da3dae32c2aa7d3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
1152	2026-08-27_f1bf0c1fdaf2fd679da3dae32c2aa7d3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2216	svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe
2216	svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe
2216	svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe
2216	svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	2026-08-27_f1bf0c1fdaf2fd679da3dae32c2aa7d3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	2216	svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 5660	1152	2026-08-27_f1bf0c1fdaf2fd679da3dae32c2aa7d3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 5660 wrote to memory of 5464	5660	cmd.exe	93
PID 2216 wrote to memory of 3396	2216	svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe	94
PID 1152 wrote to memory of 2712	1152	2026-08-27_f1bf0c1fdaf2fd679da3dae32c2aa7d3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	97
PID 2712 wrote to memory of 5588	2712	cmd.exe	99
PID 1152 wrote to memory of 3856	1152	2026-08-27_f1bf0c1fdaf2fd679da3dae32c2aa7d3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	100
PID 3856 wrote to memory of 4124	3856	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-27_f1bf0c1fdaf2fd679da3dae32c2aa7d3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f1bf0c1fdaf2fd679da3dae32c2aa7d3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBAABABBBACCBABCBAACBBBBACBACBBBCABABACCBAACCBBCAACCCAABACCCABABAACBABCAABCCACAABBBAACBAAACABABACCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBAABABBBACCBABCBAACBBBBACBACBBBCABABACCBAACCBBCAACCCAABACCCABABAACBABCAABCCACAABBBAACBAAACABABACCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBACCCCABAAAACACCBBACABBBABCCBACABBAAAAACBCBBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe" start= auto displayName= "UserDataSvc_AABBACCCCABAAAACACCBBACABBBABCCBACABBAAAAACBCBBCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBACCCCABAAAACACCBBACABBBABCCBACABBAAAAACBCBBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe" start= auto displayName= "UserDataSvc_AABBACCCCABAAAACACCBBACABBBABCCBACABBAAAAACBCBBCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBACCCCABAAAACACCBBACABBBABCCBACABBAAAAACBCBBCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBACCCCABAAAACACCBBACABBBABCCBACABBAAAAACBCBBCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4124

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCCACCAAAACABACAABABBBBBBBACBACCBAABBBCBBBACBBACBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCCACCAAAACABACAABABBBBBBBACBACCBAABBBCBBBACBBACBBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe
1⤵
- Executes dropped EXE
PID:3652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b7fd2e4760423f7150c0153e842e2d0cb28376ae4748cdc95d2e02464832362c
MD5 b328205dfc5019b2ba626f922331b9b1
SHA1 4c8bdbe33e71a8b1fd05b56ec89f88d6de7eec45
SHA512 ac151888191c507ffe8ccf30ec9e880a95efc71cdc8d2ffae22639348555f7050723d0982a3a530bf2ddf92181e43b83914419c9ac3a89b62e2a9c2e3c0b7d2f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d3762b0f0451e8231acf0a57a18b90d745cdd09bc46680dc7cce00daa3070b8a
MD5 f8b36b01e2df200a3e257ed18962b6a9
SHA1 3d3786944dc9fb925f42be4bfd0a059b024dba0e
SHA512 d2a761664b12b00e07c307d02229f11186facce577ab59f664734421d0f9c9188536433ab070d89668a4464e151c115a46aefe5f724fd4702321b6bca15dc2b2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 47ba68ae662d297d76598029184f11cd2eaf87e4e84af63a948412fd5d1e98a8
MD5 5b6d1fa96747cd1a4d01f105f8e936a1
SHA1 bfb97ad5fc3b248e4f027e8352ab863ac18345a7
SHA512 91574a77852d5e57d6b282f3cd3909a5d77e27f22fb0517024144a72a70f1153297d0c22c55b7c94a27c724f78e9cb7b12c90a40310aef36f51e1ddbe24ecf81
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b6b53eb135f28552f1c29303531128d0cafdef2ebae740b7456ea0ccf40755d1
MD5 14976d9e2301f90bed16cdf4843f626a
SHA1 d9b970f8da876bbf0e839eed22aa755bf58ea3ef
SHA512 1275e36b79a3dc1325e39046cb39d31c339d8e09054bb72302389e2f14a80d1fec618c11d78d0c25b00ae0f2a9e7b4a764698b0a305b43ac481f50b3d25b42aa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e39dfbae5b13aa28a57684f26410f148f330eaf4f4076bb1f1ca2459e0db19c2
MD5 9c57f4c184998d8763b8cf304978c604
SHA1 9f77d27c68d0616c04429219282e62e6acc73eda
SHA512 ac309cbe30fcc2d9dd135d5ff90a7735a0059c433b9a7b9753676312929f482d58c963643e65e420fc8dad852bada2d975fbf8684bddba91a6e257622ad238db
MD5 SHA1 SHA512

Submit Download

svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCCAACBBACACCBBCBBBCCBABCACBACBBBAABBBAACBBCCCCC.exe
Size 10.8MB
SHA256 eb0ec48d80e0dfbcfefc5a79a415d896a814d3b8e8d1c8d609c4619b4c1a074d
MD5 f1bf0c1fdaf2fd679da3dae32c2aa7d3
SHA1 5f82e28557ac955a09c69810880d5bb364481adb
SHA512 483a39f8ceaa1e93616a6b28b44c0e8acc048b4b0e4e2764a0d83daee728afd5396c9ee8aa7f87fe3628d8c8db10a352b35d69956747719e2ab2f03994668ef5
SSDEEP 49152:U+ES+EV+ES+EV+ES+EV+ES+EV+ES+EGq+ES+EV+ES+EV+ES+EV+ES+EV+ES+EGqv:AOU/jIEeQfoR/IuOFVjUu5Z
TLSH
T124B64C09F98740B1E97751B04CDBD2BF8630BA2583128DFFF64DC72BAA32B915834656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-0-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/1152-8-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/2216-32-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Download

memory/3432-70-0x0000000000820000-0x0000000000841000-memory.dmp

Download