6dfa8a0ad6bcf4afb239c3279c29eb232b1b4af198ca1ea36d9acf0554adb578

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-29_fd44c9cce2859ec846ef8178562ab040_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 19.1MB
Sample260830-2tm42aar9z
SHA256 6dfa8a0ad6bcf4afb239c3279c29eb232b1b4af198ca1ea36d9acf0554adb578
MD5 fd44c9cce2859ec846ef8178562ab040
SHA1 f157beae786562775b6b8d2272aa777fada2d48e
SHA512 8705847ee75eef1161943e02866133f9c869cb0007f5831fd89e47eeb70a808c226cbdbf9d7aa50010379c5d79a793eedb7c392f28ee32d9cdf284d63628df88
SSDEEP 49152:U+E7+ES+ED+Em+Es+E7+ES+ED+Em+Es+E7+ES+E2hOo+E7+ES+ED+Em+Es+E7+Ex:aLLLLLLLLoOU/jIEeQfoR/IuOFVjUu5n
TLSH
T1EE176D09F98740B1D92B50B04DDBD2BF8A30BA2187118DEBF78DC62BAA33BD16534755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
3612	svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe
3772	svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABCBACCCCACCABCABABCBCCCCBCABACCBBACBABBCBBBAACCCBCBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe"	2026-08-29_fd44c9cce2859ec846ef8178562ab040_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2288	sc.exe
5676	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
668	cmd.exe
3600	cmd.exe
4720	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-29_fd44c9cce2859ec846ef8178562ab040_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2656	2026-08-29_fd44c9cce2859ec846ef8178562ab040_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2656	2026-08-29_fd44c9cce2859ec846ef8178562ab040_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2656	2026-08-29_fd44c9cce2859ec846ef8178562ab040_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2656	2026-08-29_fd44c9cce2859ec846ef8178562ab040_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3612	svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe
3612	svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe
3612	svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe
3612	svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	2026-08-29_fd44c9cce2859ec846ef8178562ab040_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3612	svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 668	2656	2026-08-29_fd44c9cce2859ec846ef8178562ab040_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 668 wrote to memory of 3320	668	cmd.exe	94
PID 3612 wrote to memory of 5944	3612	svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe	95
PID 2656 wrote to memory of 3600	2656	2026-08-29_fd44c9cce2859ec846ef8178562ab040_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	96
PID 3600 wrote to memory of 2288	3600	cmd.exe	98
PID 2656 wrote to memory of 4720	2656	2026-08-29_fd44c9cce2859ec846ef8178562ab040_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	99
PID 4720 wrote to memory of 5676	4720	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-29_fd44c9cce2859ec846ef8178562ab040_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-29_fd44c9cce2859ec846ef8178562ab040_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCABCBBBBAABCABCACBBACBAABCABCBCCCCCBABCABCAABBBBCCBACBBABCBBCBACCCACCBBCBCCBCAACCBACCCBBCBABCCCAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCABCBBBBAABCABCACBBACBAABCABCBCCCCCBABCABCAABBBBCCBACBBABCBBCBACCCACCBBCBCCBCAACCBACCCBBCBABCCCAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCABABCACAACABBCBCCBACCCBBBABACACBBBABACCACABBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe" start= auto displayName= "UserDataSvc_BBCABABCACAACABBCBCCBACCCBBBABACACBBBABACCACABBCCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCABABCACAACABBCBCCBACCCBBBABACACBBBABACCACABBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe" start= auto displayName= "UserDataSvc_BBCABABCACAACABBCBCCBACCCBBBABACACBBBABACCACABBCCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCABABCACAACABBCBCCBACCCBBBABACACBBBABACCACABBCCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCABABCACAACABBCBCCBACCCBBBABACACBBBABACCACABBCCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5676

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5944

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe
1⤵
- Executes dropped EXE
PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a3c0ada2bca71597ff5442c525ca27702d48586eac79625cc35e1363e7a4c7be
MD5 a880c13eaccd2d8f132cca56bbd37b75
SHA1 36b8deeb1b6642c90c39ecd4a12cd731f741d1b9
SHA512 9312b90a6093c736099a11999b4e8cf1b961bf84927f89c7bf7fde23a02ca34ad44b0520cc3b29d1c5d65de68a491d8a44a48fa4dfdbc948cc764b540926ffd1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f072a4971adb9a7618036a5773b56d7b541d9c190f4f5694221c4e31cf4d41dc
MD5 38d95b61d25a62bece56f09dd64e8c3d
SHA1 2c444846a109e3cec9665028acd505886573c9a0
SHA512 ef742a3188f877d8f5b13962bf9026330d961c62192774e3c6ad0fe7c06bd4f0ff9e08436e70b213709d1567ed6d502202e062cccc2d0edda43c044ba3b77e04
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3e9d94774ee180a7fd3eaf13ec40dda3339ad80f0dee5d5384605a5ce5874edd
MD5 c5e214f43256221bf2883b5b6ef6b0c1
SHA1 e356f4e38f9fc0d989adafcbf62ac582743ab90f
SHA512 1cf0d84636cd29f723f542764409e284b05df665e0d9509cc6afdd89c784e81a1c44b99eca79e9607e04a946c9097893b3a2c0a8ef78622e3ab47682a85c8277
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8a328f2b0a8652318c571ce9c22d064bff75b097cd7f786f151218d722b3f8e7
MD5 f6b8b98ecab6d230074b3ce7d1c2334b
SHA1 51ebde6bb8d1b6b66565c802d4e49ceb348d4e3b
SHA512 36d8bac7589ec031d58e6fe48be25bfb39a44047e0638c97ff1451a290ef64dd8d9a01acb6ebabf152c97011e1fa11010b91db7e682fdf1c5b7608214c463956
MD5 SHA1 SHA512

Submit Download

svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABACCBCABCCABAABACCBCCBABCCACBABAABAACCCABBCBABCBCB.exe
Size 19.1MB
SHA256 6dfa8a0ad6bcf4afb239c3279c29eb232b1b4af198ca1ea36d9acf0554adb578
MD5 fd44c9cce2859ec846ef8178562ab040
SHA1 f157beae786562775b6b8d2272aa777fada2d48e
SHA512 8705847ee75eef1161943e02866133f9c869cb0007f5831fd89e47eeb70a808c226cbdbf9d7aa50010379c5d79a793eedb7c392f28ee32d9cdf284d63628df88
SSDEEP 49152:U+E7+ES+ED+Em+Es+E7+ES+ED+Em+Es+E7+ES+E2hOo+E7+ES+ED+Em+Es+E7+Ex:aLLLLLLLLoOU/jIEeQfoR/IuOFVjUu5n
TLSH
T1EE176D09F98740B1D92B50B04DDBD2BF8A30BA2187118DEBF78DC62BAA33BD16534755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2656-0-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/2656-8-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/3612-24-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/3612-37-0x0000000000510000-0x0000000000531000-memory.dmp

Download