617ef91a5590cb38f499b48fab241f72268d81c5b071b4b0759832855067a830

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_e13fa876ff575f945325a96c94109846_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 8.5MB
Sample260828-eq156atale
SHA256 617ef91a5590cb38f499b48fab241f72268d81c5b071b4b0759832855067a830
MD5 e13fa876ff575f945325a96c94109846
SHA1 c52c92495dd4dc56ac9852a8be8e1b3f43fb7fa5
SHA512 4dfcca06bf3f51c3bb26233f14d76beeed55dad8c41cee0270db01d736f8d0fd5326d0b5f6a859bec5f87edf4e48e6bb672d1562d5c88414ad723c8e6da5c3ce
SSDEEP 49152:U+ES+Eeg+ES+ED+ES+E7+ES+ES+E7+ES+Eeg+ES+ED+ES+E7+ES+ES+E7+ES+Een:7OU/jIEeQfoR/IuOFVjUu5m
TLSH
T18C965C05F98340F1E97711B04CDBD2BE8A70BA2586228DFBF78D871B6B32B915834756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4152	svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe
4988	svchost_AABBBAACAAAABCBBCBABCBCBCCCCBBBBBACBBCCABBBCCABACCCACAA.exe
1280	svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABCBCABACAAACAACCCAACCBBBACCBABABCAAABAABBBABCABABBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe"	2026-08-27_e13fa876ff575f945325a96c94109846_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBCBCAAABACBCACCBBBACCBCCBBCABCABBABCBBCCCABCBCBACBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBBAACAAAABCBBCBABCBCBCCCCBBBBBACBBCCABBBCCABACCCACAA.exe"	svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1668	sc.exe
1112	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3984	cmd.exe
3056	cmd.exe
1920	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBBAACAAAABCBBCBABCBCBCCCCBBBBBACBBCCABBBCCABACCCACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_e13fa876ff575f945325a96c94109846_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5432	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
916	2026-08-27_e13fa876ff575f945325a96c94109846_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
916	2026-08-27_e13fa876ff575f945325a96c94109846_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
916	2026-08-27_e13fa876ff575f945325a96c94109846_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
916	2026-08-27_e13fa876ff575f945325a96c94109846_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4152	svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe
4152	svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe
4152	svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe
4152	svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe
4988	svchost_AABBBAACAAAABCBBCBABCBCBCCCCBBBBBACBBCCABBBCCABACCCACAA.exe
4988	svchost_AABBBAACAAAABCBBCBABCBCBCCCCBBBBBACBBCCABBBCCABACCCACAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	2026-08-27_e13fa876ff575f945325a96c94109846_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4152	svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe
Token: SeDebugPrivilege	4988	svchost_AABBBAACAAAABCBBCBABCBCBCCCCBBBBBACBBCCABBBCCABACCCACAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 3984	916	2026-08-27_e13fa876ff575f945325a96c94109846_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	91
PID 3984 wrote to memory of 5432	3984	cmd.exe	93
PID 4152 wrote to memory of 2976	4152	svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe	94
PID 916 wrote to memory of 3056	916	2026-08-27_e13fa876ff575f945325a96c94109846_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	97
PID 3056 wrote to memory of 1668	3056	cmd.exe	99
PID 916 wrote to memory of 1920	916	2026-08-27_e13fa876ff575f945325a96c94109846_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	100
PID 1920 wrote to memory of 1112	1920	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-27_e13fa876ff575f945325a96c94109846_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_e13fa876ff575f945325a96c94109846_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACBBAAAACABCBBBCACBAACBCABBCBCCABCAACBBAABCCCCBBCACABCCABCCCBCCABBACACCBBBCCBABCBABCBCCACBACAAABABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACBBAAAACABCBBBCACBAACBCABBCBCCABCAACBBAABCCCCBBCACABCCABCCCBCCABBACACCBBBCCBABCBABCBCCACBACAAABABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBCABCAABACABCAAACCCCABBACCCCCBACBCCABAABAAACCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe" start= auto displayName= "UserDataSvc_CCBBCABCAABACABCAAACCCCABBACCCCCBACBCCABAABAAACCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBCABCAABACABCAAACCCCABBACCCCCBACBCCABAABAAACCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe" start= auto displayName= "UserDataSvc_CCBBCABCAABACABCAAACCCCABBACCCCCBACBCCABAABAAACCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBCABCAABACABCAAACCCCABBACCCCCBACBCCABAABAAACCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBCABCAABACABCAAACCCCABBACCCCCBACBCCABAABAAACCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1112

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2976

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBAACAAAABCBBCBABCBCBCCCCBBBBBACBBCCABBBCCABACCCACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBAACAAAABCBBCBABCBCBCCCCBBBBBACBBCCABBBCCABACCCACAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe
1⤵
- Executes dropped EXE
PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6be9ef53e883b6232311275293c74d71550e1a85730122d520c588ca21de5d19
MD5 092c93b5de5338ca6004b961e4320880
SHA1 77a07c788f03f3744f3fa134d33bbbfe91956368
SHA512 8815f5424d85d6aa3f22f7e8a28657bd109dd48c568493ccb2e7c19e6e3cbece72dc30671ad88e00ef18c74f7e89deb0ba0515fe4ccf1456efd9b0185c59e039
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9986b04367eb93e53171b31deb69c119a373c889ed757d7dc250574a04665ffc
MD5 3bf5e8d44457da97a60aab67ef8211dc
SHA1 96240516a1cefe91d971c79234fe4d9a494828fc
SHA512 5e2540f4cf6d72598b13c0e90bcfaf3065108206bc182e1562e4755ef9cea64a69eb8e302f1c32d9d4091b39901102c15395e56568c461b0723fa0a9712f82cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c395a344f885173328a1b320a75b506aa4a5edd61aaedd8191e0ad492a81e70f
MD5 a585bfd18b6c38c04c169f0ecd8581b7
SHA1 1f3bebe14e156c5b191c598aaeee9b2a50b4a80d
SHA512 55285d3440781f2317a6f7d8ff4478d94749f81bd62150e3f53e91c74ab1ace20d29b17c690e629d560d03866eedd1423d75b2ddde0cbca8180b52c64210b34d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6824db64b9af31b443cc72efc9734078dace6176b24af6bed7f8567544cffafd
MD5 c42be2b5346cd693fcefa31126cef808
SHA1 ba5ea1463aff5645df509b6f64fcb93feb14f22d
SHA512 bdfe367fc00c51768ddcef7f31b0e1322889769888768e1e2d86b7504763f1d43a626094a82176f0a6c0475a83552d037dc6b13b3bf0e04da73352caeeb72ca8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eda9896c2051033a506ab80f99718d3bfa5eed7a6e608db58a40778fd0fb37d8
MD5 d43ff88f98216e12b2819ccac47898af
SHA1 b1671becd17b8a7cb37344a26670950744464373
SHA512 d7b786af9ff05d7c1fe4bc283e3fc8b0cc8f0d7fb21f78b5d99d8158ee30c1413ceabf3f83f3cf0766ef843964b415f77a82d2c01ec9b422ee9366756104f4bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8553195d937c51b63a75e625f8c1dbc079ea51562e11080196ca93d55f1db68f
MD5 8d36d4550000f5f32a014272b5c3f0a5
SHA1 f73b4d59a80686f7ecd366a04cd8acde7c1d7792
SHA512 fe398ae095e747a39bb1346f6ae1a4d7245814ec0b7526c793f64d7ac2fc90681f09af442aa2336033a697e3b9c5741a6e87a7d7be9ced04fcfb224e44c2413d
MD5 SHA1 SHA512

Submit Download

svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBCABCACBBAABCBBCBABBABABCCACBBACBACACCAABCACAACBCBC.exe
Size 8.5MB
SHA256 617ef91a5590cb38f499b48fab241f72268d81c5b071b4b0759832855067a830
MD5 e13fa876ff575f945325a96c94109846
SHA1 c52c92495dd4dc56ac9852a8be8e1b3f43fb7fa5
SHA512 4dfcca06bf3f51c3bb26233f14d76beeed55dad8c41cee0270db01d736f8d0fd5326d0b5f6a859bec5f87edf4e48e6bb672d1562d5c88414ad723c8e6da5c3ce
SSDEEP 49152:U+ES+Eeg+ES+ED+ES+E7+ES+ES+E7+ES+Eeg+ES+ED+ES+E7+ES+ES+E7+ES+Een:7OU/jIEeQfoR/IuOFVjUu5m
TLSH
T18C965C05F98340F1E97711B04CDBD2BE8A70BA2586228DFBF78D871B6B32B915834756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 79b1726130a277a81cda2d248a0f5a1b1972a4aed264fbe507d6641d5eb88471
MD5 89cd383de738e8f6d000fb3fb0ec8008
SHA1 f47e940a78c09ee8608abc6ad1dc796869625fcd
SHA512 b435faca8f1aa50954d2807027e74c1b184ef59de5c9cacfe828e12eb8da63b8b1b96e42bb4de25f07636bc093930752d91e4d4c8ed07babc209e0251b1ebd23
TLSH
T134117D60A4F4D813E832644B122ACBD65DE8339E5C786A1A1348831D77D8D318F9C0D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/916-8-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/916-0-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/4152-24-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/4152-34-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/4988-79-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download