a8c0dd7ab837eda0f48b108f31f765053e0eb748fb7f1eadef0f9e15883df837

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_f517ce495c2c193de27660b220053e62_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 2.8MB
Sample260831-a3eepseb69
SHA256 a8c0dd7ab837eda0f48b108f31f765053e0eb748fb7f1eadef0f9e15883df837
MD5 f517ce495c2c193de27660b220053e62
SHA1 a4fe4f462a1d16e766e748930a9f64b6d0dbc4ca
SHA512 8909974562cf940c3c06c8b2297c9250894e1dde24f21b5599a5e5ebd3f84798916ae4d1df5f12fb4effcf130df7d373b8f4cacfbe884b453b47af4290ec478c
SSDEEP 49152:U+Eo+E/+EO+ES+Eo+EOOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp4:LOU/jIEeQfoR/IuOFVjUu5m
TLSH
T145D59D11F9C68032E5B312314DAAC2795674B9A5873289EFF3CC461F5F31AC19A36B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
1564	svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe
3328	svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACCCCCBBAAABCACABACACCAAACBCCABCCCBACCCBCACCCAAACAABBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe"	2026-08-30_f517ce495c2c193de27660b220053e62_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4480	sc.exe
6080	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
572	cmd.exe
5908	cmd.exe
1572	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_f517ce495c2c193de27660b220053e62_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3592	2026-08-30_f517ce495c2c193de27660b220053e62_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3592	2026-08-30_f517ce495c2c193de27660b220053e62_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3592	2026-08-30_f517ce495c2c193de27660b220053e62_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3592	2026-08-30_f517ce495c2c193de27660b220053e62_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
1564	svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe
1564	svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3592	2026-08-30_f517ce495c2c193de27660b220053e62_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	1564	svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 572	3592	2026-08-30_f517ce495c2c193de27660b220053e62_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 572 wrote to memory of 5552	572	cmd.exe	94
PID 3592 wrote to memory of 5908	3592	2026-08-30_f517ce495c2c193de27660b220053e62_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	95
PID 5908 wrote to memory of 4480	5908	cmd.exe	97
PID 3592 wrote to memory of 1572	3592	2026-08-30_f517ce495c2c193de27660b220053e62_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	98
PID 1572 wrote to memory of 6080	1572	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-30_f517ce495c2c193de27660b220053e62_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_f517ce495c2c193de27660b220053e62_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACABBCCBACAAACBCAAABBCBBCBAAACAACBACBAABCACACCCBACBABACBBAACACACBCCBAABBCBBCACCCBAAABAABACCABCBAABCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACABBCCBACAAACBCAAABBCBBCBAAACAACBACBAABCACACCCBACBABACBBAACACACBCCBAABBCBBCACCCBAAABAABACCABCBAABCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAACBCBBBABAABBBAABAACBCBCCCBCCCABCAAAACCCCCCABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe" start= auto displayName= "UserDataSvc_ABAACBCBBBABAABBBAABAACBCBCCCBCCCABCAAAACCCCCCABCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5908
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAACBCBBBABAABBBAABAACBCBCCCBCCCABCAAAACCCCCCABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe" start= auto displayName= "UserDataSvc_ABAACBCBBBABAABBBAABAACBCBCCCBCCCABCAAAACCCCCCABCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAACBCBBBABAABBBAABAACBCBCCCBCCCABCAAAACCCCCCABCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAACBCBBBABAABBBAABAACBCBCCCBCCCABCAAAACCCCCCABCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6080

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe
1⤵
- Executes dropped EXE
PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f622252d8688ba81d6bbd25552d39c546d5e5dbd97c0f53b016ced8ec71fe028
MD5 3a97d84c09a741cb7c8a3036249f52d4
SHA1 82c10d683561a36d51f9bb9a938dcc87651b268c
SHA512 4b47a2c50ff8ba86be3c32e0b1a0dd70ae9055b17186ca5683f5bc9bf3e1c18199c24264bcfe8efa29fafc4cd481a53058b55f56cbf4eb15fbeffc0534450306
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 06c15b0f632a30cd9a441d55abd264ff15a7729387bd46cdcfb8173e7ff1cbd7
MD5 17a94ecda0ca3524f51bdb90fe7d5382
SHA1 f323a5c71b8052999bf2f4ef4fd685dd1f61c11c
SHA512 201d9551489f8cecd01cb11478625ae5a64641516e4af1d4277be39aa61eee67ad39c3920014fd7851dd87d7a98c1af1bb04a9ffbe2d35df5d9e4c1ad121eeac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0e32414a8c8e70974324c16386bf804beae1ff36a6e2f4658ae6fce217580359
MD5 9057d7a6ada26f97423e6cc58e7613cd
SHA1 9d1d9ea85012ab778c6bc6f82819a208d9c78fcd
SHA512 97b5bcaac6fa71f861b2c8e18c98fb6eab9bfdcbcc0b0b61e2a42b3f342d1c4b957072e33999d51c76c39b6548c774efa025e73e9d01d998a736363b99dafdf0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ac176d8cb6110b6852a28a7a637c44aa843f99aeeddca3cd5fc134c02039cf1b
MD5 776581adf6b94b9a2baf6d6d07d4328a
SHA1 1209a3226d73b3a11ef34fc6d921976e9001117e
SHA512 8a60c60af4b6b8b7f59e69d5a7e03b5901407cbf2e31f49f82c001d4d61646104e3cb87d50d92c34b5e3bac79284e71a93c2dcaf6aa8d732fbd727d2d065884d
MD5 SHA1 SHA512

Submit Download

svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBAAACCAAAACAACBACBACCCBCCABCABBACACCAAABBBCBBAABAB.exe
Size 2.8MB
SHA256 a8c0dd7ab837eda0f48b108f31f765053e0eb748fb7f1eadef0f9e15883df837
MD5 f517ce495c2c193de27660b220053e62
SHA1 a4fe4f462a1d16e766e748930a9f64b6d0dbc4ca
SHA512 8909974562cf940c3c06c8b2297c9250894e1dde24f21b5599a5e5ebd3f84798916ae4d1df5f12fb4effcf130df7d373b8f4cacfbe884b453b47af4290ec478c
SSDEEP 49152:U+Eo+E/+EO+ES+Eo+EOOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfkptVxp4:LOU/jIEeQfoR/IuOFVjUu5m
TLSH
T145D59D11F9C68032E5B312314DAAC2795674B9A5873289EFF3CC461F5F31AC19A36B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1564-25-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/1564-38-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/3592-0-0x0000000000190000-0x00000000001B1000-memory.dmp

Download

memory/3592-8-0x0000000000190000-0x00000000001B1000-memory.dmp

Download