86df7fe27a09d74a49830aedafbbaf22b825e4d1106f0e577a5aa693cc992f8a

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_e67bdfd0f17ff998f0e655f550fc6452_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 6.1MB
Sample260828-d3bwcsbf99
SHA256 86df7fe27a09d74a49830aedafbbaf22b825e4d1106f0e577a5aa693cc992f8a
MD5 e67bdfd0f17ff998f0e655f550fc6452
SHA1 3fcbd8eafdb6970de9be1ea124ad3f4cf97fcf3b
SHA512 0b018ece50c6704bdb40df2dd12a9b3870e8756fcb85454711e31e63552853f128ce45ea7a59caef818d41057faee00000d5fdeaeca40b0294d0d7742f285ec9
SSDEEP 49152:U+ES+E7+ES+Eeg+ES+ED+ES+E7+ES+ES+E7+ES+Eeg+ES+ED+ES+E7+ES+ES+E7+:hOU/jIEeQfoR/IuOFVjUu5m
TLSH
T151566C05F98340B1E97711704CDBD2BE8A70BA2587328DEBF78D861F6B32B919835716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5484	svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe
868	svchost_ABAABACBBCBCBCCBBCABACBACBCACBCABCCABBCABBABCACBCCABCAB.exe
6080	svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBAAABBBCCBCBAACBBBCCCCCBBACCBACACBAAAABCAACABBCCCCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe"	2026-08-27_e67bdfd0f17ff998f0e655f550fc6452_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAACBAAAABACCAACCCACCAABCCABAACCCBBCCCCCBBCBAABCCACAACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAABACBBCBCBCCBBCABACBACBCACBCABCCABBCABBABCACBCCABCAB.exe"	svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1192	sc.exe
4820	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3280	cmd.exe
2040	cmd.exe
3128	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_e67bdfd0f17ff998f0e655f550fc6452_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAABACBBCBCBCCBBCABACBACBCACBCABCCABBCABBABCACBCCABCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4368	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2768	2026-08-27_e67bdfd0f17ff998f0e655f550fc6452_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2768	2026-08-27_e67bdfd0f17ff998f0e655f550fc6452_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2768	2026-08-27_e67bdfd0f17ff998f0e655f550fc6452_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2768	2026-08-27_e67bdfd0f17ff998f0e655f550fc6452_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5484	svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe
5484	svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe
5484	svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe
5484	svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe
868	svchost_ABAABACBBCBCBCCBBCABACBACBCACBCABCCABBCABBABCACBCCABCAB.exe
868	svchost_ABAABACBBCBCBCCBBCABACBACBCACBCABCCABBCABBABCACBCCABCAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2768	2026-08-27_e67bdfd0f17ff998f0e655f550fc6452_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5484	svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe
Token: SeDebugPrivilege	868	svchost_ABAABACBBCBCBCCBBCABACBACBCACBCABCCABBCABBABCACBCCABCAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 3280	2768	2026-08-27_e67bdfd0f17ff998f0e655f550fc6452_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 3280 wrote to memory of 4368	3280	cmd.exe	94
PID 5484 wrote to memory of 4964	5484	svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe	95
PID 2768 wrote to memory of 2040	2768	2026-08-27_e67bdfd0f17ff998f0e655f550fc6452_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 2040 wrote to memory of 1192	2040	cmd.exe	100
PID 2768 wrote to memory of 3128	2768	2026-08-27_e67bdfd0f17ff998f0e655f550fc6452_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 3128 wrote to memory of 4820	3128	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-27_e67bdfd0f17ff998f0e655f550fc6452_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_e67bdfd0f17ff998f0e655f550fc6452_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBCACCAAACAAAAAAACBCBCABCCACABBCABCAABBCBBBABCCABCCCCACBACBABABABBCBBBAAAACBCBCCCACBAAABCCABCBAACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBCACCAAACAAAAAAACBCBCABCCACABBCABCAABBCBBBABCCABCCCCACBACBABABABBCBBBAAAACBCBCCCACBAAABCCABCBAACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCBBBCCBBBBCBCBBBCBCBCBAABACAAACACCCABBCAABABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe" start= auto displayName= "UserDataSvc_CBACCBBBCCBBBBCBCBBBCBCBCBAABACAAACACCCABBCAABABBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACCBBBCCBBBBCBCBBBCBCBCBAABACAAACACCCABBCAABABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe" start= auto displayName= "UserDataSvc_CBACCBBBCCBBBBCBCBBBCBCBCBAABACAAACACCCABBCAABABBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCBBBCCBBBBCBCBBBCBCBCBAABACAAACACCCABBCAABABBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACCBBBCCBBBBCBCBBBCBCBCBAABACAAACACCCABBCAABABBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4820

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4964

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACBBCBCBCCBBCABACBACBCACBCABCCABBCABBABCACBCCABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACBBCBCBCCBBCABACBACBCACBCABCCABBCABBABCACBCCABCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe
1⤵
- Executes dropped EXE
PID:6080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0daf28b605a633093cf5282d318a24dcce3790db83d73691a49152757a028a5b
MD5 fbf5189dcb78345e44d625ea872f3690
SHA1 ee2607704fd621e49af09d70d08a61d8dbd32c82
SHA512 4e36db1e5785dfccea4d00ed9facab2171a1edea1ecee73acce7764c867ac543f1b8c77bd261f0eda8b2ab306d23b8a2b17c73c183a9d310e1d63dd472e4198e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9a0a7c647926d4296bb442edc6ba5a3a856d124ca7290315a468cd643190e7b6
MD5 c24a1e16496a2c52e346219064f500a5
SHA1 f01d0abee54061c56ab2c3e6be2bd93d63329aa2
SHA512 bcde6c4078b27a2661c5f6f20d9dd8782a3244bedaeb98e47c29c9e18a9d94378ec4cf88e0db948aeef97a6b345c1f09cf7a75b46946a8fd665d3c9b3213a0f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fd4d626047d10784725b5c5927b92d3ee9651b9ba81c953bbc15bdff3dd2849c
MD5 427ba759b831dc9a1a40c82ec20cb3c7
SHA1 20aae2410998f0d290bdb52957cdb9b4c80a93a4
SHA512 98980c916ca78d06b439e381b88e4f2f4cf9b1e0a39a86e032515f262ee030c79c5bdf9b4235d76dd3ea68aff01d38f0946aa63f3434b50c7230ff81d8ef055d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8036fbb690e6631530a461f891a16603bb23babfa2353a5f730b00518d173c5c
MD5 1b4e4f29e7fbb1505d8d26500aa1b60f
SHA1 7fc9dcb25a8c56bffee05c60c3746641c887a0a8
SHA512 80988d0cc0855bb1499997048850023ddd3f1c289bc80bb8a9128ffb36550cf43ee905838acdd4c5734c670be093b666a7496108bc6072075e5c418bbd4762e1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 217dc393846622e895d064229b170dd659203fc0387b1db4309a3d24984573d6
MD5 b8bd6dfd54bbccb137ec5e49dec2c983
SHA1 21cc3b6f943b6d7d04e5749afb20395530a60eea
SHA512 00eae914fbdd7e78a3f30f058adf60c96aadcd57547b665babd40484bc9b1a09f5ed0c167a35648079003eb94dd2a5e5322a38dd7e161b7b0ac3ac9c66c63c2d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c1eb280100cdd2bb959b36b4b8b41ce68ac12514fbe182060af43703468c8f88
MD5 e2efb24b2ef89959f6a78e13ac624a85
SHA1 c7afcab3aeb1d092d6b7d023e41170dcc83ae670
SHA512 6a0d16153d2e6195736d672ba7d6c1da4ae1a4aac1cd0f67d2a195f4f622841c176626b5c1ec3cdcf3b6fe9906fd284034df82bb89d95aa176002958497c8106
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c6fc21b2be6fde6b36e31f81b79b12b649aa6f85690169b44f637aa2ec8985e7
MD5 b3976ece46410512b4fd45557303cb2a
SHA1 ee69256cfd4cb52c742df186431b1b52e6dc7db4
SHA512 ced8cc63daeeb05ecc15ab79691cd8ab9587389d95c53bcf92aa0bb1e2359d8585195cc78014cbedbb6218ad3dfb079d984e63d366cc532837d0a0956bc8aa9b
MD5 SHA1 SHA512

Submit Download

svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBCBCCBCBBCBCCCABCABABBCABBCCCACCBACBAABBABACBACBA.exe
Size 6.1MB
SHA256 86df7fe27a09d74a49830aedafbbaf22b825e4d1106f0e577a5aa693cc992f8a
MD5 e67bdfd0f17ff998f0e655f550fc6452
SHA1 3fcbd8eafdb6970de9be1ea124ad3f4cf97fcf3b
SHA512 0b018ece50c6704bdb40df2dd12a9b3870e8756fcb85454711e31e63552853f128ce45ea7a59caef818d41057faee00000d5fdeaeca40b0294d0d7742f285ec9
SSDEEP 49152:U+ES+E7+ES+Eeg+ES+ED+ES+E7+ES+ES+E7+ES+Eeg+ES+ED+ES+E7+ES+ES+E7+:hOU/jIEeQfoR/IuOFVjUu5m
TLSH
T151566C05F98340B1E97711704CDBD2BE8A70BA2587328DEBF78D861F6B32B919835716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3fd8575f0a2698653a3dfd2cdf933d1f5ee2cbba16e6ae9edee47dcb39b97b16
MD5 75bef8a13ed741f08ab52ae0b9efc1ce
SHA1 6406f996097b680b0dd7751c1c2f8dc65cdb16dd
SHA512 6476c48397559285fc2fddca914a775f134bc1e6273043f6bbcc60d81456e4fb540e2faa2827cdde4a3e648e9400328a92e11c8f940c9c34c49d8b7f12f91dad
TLSH
T1AD110A91F4F5DC33D432A4CB6326C9E358E437EAAC5CEE2593488218ABD5D334DA50E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/868-65-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/868-82-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/2768-0-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/2768-8-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/5484-34-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download