6ba739de82f988b84028b1a29c64dc0e5eca03dc25f09f5f4f02aae3cd48dd67

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_dbf3735b846656335a5fa83ec511ae8a_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Size 9.0MB
Sample260828-e9wpsasye1
SHA256 6ba739de82f988b84028b1a29c64dc0e5eca03dc25f09f5f4f02aae3cd48dd67
MD5 dbf3735b846656335a5fa83ec511ae8a
SHA1 212d7b97af8d91649395df66e6f7668737a10829
SHA512 d09935ebc1e940b00337191b4745e55a8fed4f25e82fd0797e2656f01bf9d0a3b93db406232b649c65ee13d6f4b363515b25eb0e0e765b43b460edcf91fbbd1e
SSDEEP 98304:g1MbQ9yDAD7KjjqkusjuOU/jIEeQfoR/IuOFVjUu5m:g1tIDewjqkjCFIF0wuQ
TLSH
T1D5968E29EAF440F5F9BB9478696BC232EA717A110133574FEAD4C21BAF336424D29731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3108	svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe
2324	svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe
3016	svchost_CCCCAABCCBAACAABACCBBAAAABACABAACBABBAACABBBCCACBCBBCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBACACAAAABBCCCCCCACBCBBBCBCAAABCBBCABAAAACBAAAACBABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe"	2026-08-27_dbf3735b846656335a5fa83ec511ae8a_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAACCACBAACBAACBCCBBCBCABCBBAAAABBAACACACBBABAACCCBBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCAABCCBAACAABACCBBAAAABACABAACBABBAACABBBCCACBCBBCBA.exe"	svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2820	sc.exe
2452	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3928	cmd.exe
4964	cmd.exe
4868	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCAABCCBAACAABACCBBAAAABACABAACBABBAACABBBCCACBCBBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_dbf3735b846656335a5fa83ec511ae8a_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4480	2026-08-27_dbf3735b846656335a5fa83ec511ae8a_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
4480	2026-08-27_dbf3735b846656335a5fa83ec511ae8a_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
4480	2026-08-27_dbf3735b846656335a5fa83ec511ae8a_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
4480	2026-08-27_dbf3735b846656335a5fa83ec511ae8a_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
3108	svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe
3108	svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe
3108	svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe
3108	svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe
3016	svchost_CCCCAABCCBAACAABACCBBAAAABACABAACBABBAACABBBCCACBCBBCBA.exe
3016	svchost_CCCCAABCCBAACAABACCBBAAAABACABAACBABBAACABBBCCACBCBBCBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	2026-08-27_dbf3735b846656335a5fa83ec511ae8a_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Token: SeDebugPrivilege	3108	svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe
Token: SeDebugPrivilege	3016	svchost_CCCCAABCCBAACAABACCBBAAAABACABAACBABBAACABBBCCACBCBBCBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 3928	4480	2026-08-27_dbf3735b846656335a5fa83ec511ae8a_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	92
PID 3928 wrote to memory of 3384	3928	cmd.exe	94
PID 3108 wrote to memory of 4936	3108	svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe	95
PID 4480 wrote to memory of 4964	4480	2026-08-27_dbf3735b846656335a5fa83ec511ae8a_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	96
PID 4964 wrote to memory of 2820	4964	cmd.exe	98
PID 4480 wrote to memory of 4868	4480	2026-08-27_dbf3735b846656335a5fa83ec511ae8a_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	99
PID 4868 wrote to memory of 2452	4868	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-27_dbf3735b846656335a5fa83ec511ae8a_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_dbf3735b846656335a5fa83ec511ae8a_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBAAABCBBBBACBACBABABACAAACABBBAACBACBBBAABCCABCABCAAAACABBCBABBBCBCACABBAAACCCCBCCCCCCBCCAABAAACBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBAAABCBBBBACBACBABABACAAACABBBAACBACBBBAABCCABCABCAAAACABBCBABBBCBCACABBAAACCCCBCCCCCCBCCAABAAACBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBBCBBCBAACBCCABCBCCCBAAACABBCBBBBAACBBABACABBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe" start= auto displayName= "UserDataSvc_ACBBBCBBCBAACBCCABCBCCCBAAACABBCBBBBAACBBABACABBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBBCBBCBAACBCCABCBCCCBAAACABBCBBBBAACBBABACABBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe" start= auto displayName= "UserDataSvc_ACBBBCBBCBAACBCCABCBCCCBAAACABBCBBBBAACBBABACABBCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBBCBBCBAACBCCABCBCCCBAAACABBCBBBBAACBBABACABBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBBBCBBCBAACBCCABCBCCCBAAACABBCBBBBAACBBABACABBCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe
1⤵
- Executes dropped EXE
PID:2324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCBAACAABACCBBAAAABACABAACBABBAACABBBCCACBCBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCBAACAABACCBBAAAABACABAACBABBAACABBBCCACBCBBCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 77932b2bf7fe107037611572bbbd4de567b56d1c29e84f2ac65433040ba914d2
MD5 376b4408134ac52af2eac339163e5b50
SHA1 00afc09838ad2981d8902c06fb44c78387dd8e7f
SHA512 eacb1c07cade57e7d8c6820408d3c509966d7ff45fa31edf245621237115510e05692e7244d615c5f5c4615cdad290aad66d6b712f7ef9aaf345c2451a666f83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4a3a845db98b8f37ed3d292ff5944a00162afd69426afcea4cb55e65038f92d4
MD5 ef66ba5dae5c0132f8c90dc896d7d206
SHA1 15a6267b949b3aa156df47b0934cbb95be4a04f0
SHA512 ca8484ebf95d86019d884ed6f2d38bb6f44b62db7158f6d9303a785390a8e12cb1b79b6e58343b933f39f679669c5f0e3afbb64620dad2c427f3a82b47a0ff6b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ebac009fa45e6981c027264f45016e54633ff5fe9dd2920cf7e72b660057b817
MD5 3399b9977e5125493d7507cfcebcb432
SHA1 435170bb695209ca74b4576367f7528b46953dab
SHA512 b768a0a1a5c62be87483ff943e614d5afd488c1f375613075322330c5d026f7b06d8bd1c8b8f62f1c0a021da24867d46a93635f0d7d3ee36f32ed4565c642098
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 198019912740b3b2a00056b829d407d5417e2ecd1b7685c6d8159490e2d34b8d
MD5 6e1e9f5aa04e167c3ff6de238787702e
SHA1 58f048f726bf93a74107b08f630b2e75a8b0137f
SHA512 ebfcb7f0aadc25edf5d9b7ba98865ebc8f284536d8f454368d137fab15234a1feafe5cdb9736d67fbfe2008209044c16a56d1c91786ef5ed7bb536e5510a4758
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 eb87a679b203ff0a223334cbdbd2191b48d4979efacaae573ef70009825b5f60
MD5 46bb7b7d0f02b2cefba9f76710b2efc2
SHA1 26dee45a804623204c892cbd02da3571e641818c
SHA512 94d3c0c9493b52bdf8163ee56d9d18b7486ef3b87dd61bc58171de6ef84cf7bfd26ee1a1a80d3783415f6e1c830fcaf933bcdb9a8206f1d9d686a7acc780bce3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1234a022aa8d6fe3b50012ef5f83a966c1d76aa95620e7c35d456a73dae9d217
MD5 a9589c4b7fac1938602a86c882bec3b2
SHA1 c0177afe67eb64a780eabea56c8726faef9e0d8a
SHA512 e379cfd1173c2fcb306b9a2bdfed45604f4d3b8d942b29fa67e953680c49f79f0e4a258b04b86fe521e21d58ddcd0a418d24282697dd61e9746e8b69acbfb7ee
MD5 SHA1 SHA512

Submit Download

svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCAABACCCAAACBAAAACBCCBAAABBCACACACCBCCAABBBBCABACCC.exe
Size 9.0MB
SHA256 6ba739de82f988b84028b1a29c64dc0e5eca03dc25f09f5f4f02aae3cd48dd67
MD5 dbf3735b846656335a5fa83ec511ae8a
SHA1 212d7b97af8d91649395df66e6f7668737a10829
SHA512 d09935ebc1e940b00337191b4745e55a8fed4f25e82fd0797e2656f01bf9d0a3b93db406232b649c65ee13d6f4b363515b25eb0e0e765b43b460edcf91fbbd1e
SSDEEP 98304:g1MbQ9yDAD7KjjqkusjuOU/jIEeQfoR/IuOFVjUu5m:g1tIDewjqkjCFIF0wuQ
TLSH
T1D5968E29EAF440F5F9BB9478696BC232EA717A110133574FEAD4C21BAF336424D29731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 8f4c1bc2568a27aa0228c040c3599933c4645cacefc8b8af8595e1043f4c2832
MD5 57dbe8ff39b97f5ebaeb94c57126208c
SHA1 f9817db8eadb8e65a3c24e0769a178f3dd2d8cee
SHA512 a67dbe38c4a32b49d3b156f3ad5e9ec39afa8303bf9bf444dd1f17f2c1164a8d0fc660a171db5a377d039877cc3215386aa9225162afa54b0a28cb427d68d28b
TLSH
T1F211043174F5C813F53328D7A119CF8BACA5329F5C986A5D62089718A7E5C208D998E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2324-66-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/3016-72-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/3108-22-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/3108-35-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/4480-6-0x0000000000460000-0x0000000000481000-memory.dmp

Download