1ac9c38ac2d647a387a7ec6cb79dae96686f2dd3d88dd2e3816b47d127cb612f

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_4d4dfcc0d5db134d8b67cd35d9dbb1cb_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Size 13.4MB
Sample260831-nt6pgstvbs
SHA256 1ac9c38ac2d647a387a7ec6cb79dae96686f2dd3d88dd2e3816b47d127cb612f
MD5 4d4dfcc0d5db134d8b67cd35d9dbb1cb
SHA1 7d68d08a097ab1a6e6f35b818c0759f45b35e937
SHA512 5169e1692c59893735e6533117a401ecc2f31f0d37157c881f53467344384882b771f99f2557097261b425168fcb989009f7ed7b84620d9ecbddeaa0979b6702
SSDEEP 98304:6/mm/mm/mm/mm/mmEOU/jIEeQfoR/IuOFVjUu5m:6/mm/mm/mm/mm/mmEFIF0wuQ
TLSH
T17EE66C09F99244F1D967417049CBD27ECA70BA2186228EEBF74DC71B6F23B91AC39711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3280	svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe
5624	svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe
3852	svchost_CBAAAAABABACAACBAACABBACCCAAAABBACCACBACABAABBCCACBACCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBACCCBABACAAACCCCACCAACABCCCBBCCABBAACBCAABCBCABBAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe"	2026-08-30_4d4dfcc0d5db134d8b67cd35d9dbb1cb_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCACAACCBBAABBCBBBBACCCACCBACBCCCBCBBABCBBABBAAAACCCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAAAAABABACAACBAACABBACCCAAAABBACCACBACABAABBCCACBACCC.exe"	svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1548	sc.exe
1012	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2116	cmd.exe
1768	cmd.exe
4984	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAAAAABABACAACBAACABBACCCAAAABBACCACBACABAABBCCACBACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_4d4dfcc0d5db134d8b67cd35d9dbb1cb_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2768	2026-08-30_4d4dfcc0d5db134d8b67cd35d9dbb1cb_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
2768	2026-08-30_4d4dfcc0d5db134d8b67cd35d9dbb1cb_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
2768	2026-08-30_4d4dfcc0d5db134d8b67cd35d9dbb1cb_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
2768	2026-08-30_4d4dfcc0d5db134d8b67cd35d9dbb1cb_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
3280	svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe
3280	svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe
3280	svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe
3280	svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2768	2026-08-30_4d4dfcc0d5db134d8b67cd35d9dbb1cb_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Token: SeDebugPrivilege	3280	svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2116	2768	2026-08-30_4d4dfcc0d5db134d8b67cd35d9dbb1cb_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	91
PID 2116 wrote to memory of 3868	2116	cmd.exe	93
PID 3280 wrote to memory of 2856	3280	svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe	94
PID 2768 wrote to memory of 1768	2768	2026-08-30_4d4dfcc0d5db134d8b67cd35d9dbb1cb_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	95
PID 1768 wrote to memory of 1548	1768	cmd.exe	97
PID 2768 wrote to memory of 4984	2768	2026-08-30_4d4dfcc0d5db134d8b67cd35d9dbb1cb_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	98
PID 4984 wrote to memory of 1012	4984	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-30_4d4dfcc0d5db134d8b67cd35d9dbb1cb_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_4d4dfcc0d5db134d8b67cd35d9dbb1cb_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCACCACABBBCAACBBBCBCACABCAAAAABCABCACCBACCCBCBAABBBCAAABCBBCBBBACACBBBCBBCBBBABCBAABACCBCCAACACCACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCACCACABBBCAACBBBCBCACABCAAAAABCABCACCBACCCBCBAABBBCAAABCBBCBBBACACBBBCBBCBBBABCBAABACCBCCAACACCACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCABCABACBCCBCABCABCCACCBBCAAAACBABCCACBCBAAACAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe" start= auto displayName= "UserDataSvc_BBCABCABACBCCBCABCABCCACCBBCAAAACBABCCACBCBAAACAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCABCABACBCCBCABCABCCACCBBCAAAACBABCCACBCBAAACAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe" start= auto displayName= "UserDataSvc_BBCABCABACBCCBCABCABCCACCBBCAAAACBABCCACBCBAAACAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCABCABACBCCBCABCABCCACCBBCAAAACBABCCACBCBAAACAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCABCABACBCCBCABCABCCACCBBCAAAACBABCCACBCBAAACAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1012

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe
1⤵
- Executes dropped EXE
PID:5624

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAAABABACAACBAACABBACCCAAAABBACCACBACABAABBCCACBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAAABABACAACBAACABBACCCAAAABBACCACBACABAABBCCACBACCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 735775c0b4fb763615c689b9f1a7cd499a53d5e55d2b3db72a6c0679ef6d58f1
MD5 6fe2c3dbec2e2bcc619a4d89dda25185
SHA1 664e5b20786ed0165d35d9b0dd590a2a52fd0515
SHA512 c353df6465108c3f1b2b310742db1867e1e6bc5f4e0f053f78976437d83edcefdd4945fa7955aaa39d21602d94b31ee6ba011451687234f97343cd34fe15ae1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 38c272dc032a0da862c780c265281dc237859378b9ababbd933264f60334884f
MD5 b0d324936d1e19422808cb8748ebcf9c
SHA1 232d9276ee90fcf718e533606b4860b8586656fb
SHA512 0933131127bfa3d272910704b96c5061cf7da990035d0c9d301dee708039fb1fd25b641b224d274dc1de95ddcdd58eb91b4166eed57eea273c3feb1112ab77f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1021dcbf233bc69b70c6aa15d64dd2841bc4ae69f151a1a8973cd679f337a77b
MD5 ec3945d31f9b728cd232a59e540bc508
SHA1 dc4cbfc0aef17ccd30a00c4b9aa5a70f6adc1a5a
SHA512 b106d38024a0b03944227097ccafaf9bb33608eec4b1f817bc5540a8d28e31945f20db98a2cd82797a7ea29b55bad3e3fc54c4474a3faa8e5efacd2e00fc7f38
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6e7cf8b8456854033aa4cb698df12e5c31f5b94be027047612116b8911ccc1d2
MD5 5df7f1701caab7a2829ab3601e892619
SHA1 12c1399dddc1d8d88107b31eb70ae557db755750
SHA512 a58e6c45787347db959851f95f4b75908e041f3ab37962de6a163304ac98cd8b204f7f5384a4e13d08ce6a4ed8d8de4d0e6f31504246eeb3acd13b50f478b327
MD5 SHA1 SHA512

Submit Download

svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABCBABCBAABCACCCBACCBAABCACCBCABBAABACCBAAACACBCBC.exe
Size 13.4MB
SHA256 1ac9c38ac2d647a387a7ec6cb79dae96686f2dd3d88dd2e3816b47d127cb612f
MD5 4d4dfcc0d5db134d8b67cd35d9dbb1cb
SHA1 7d68d08a097ab1a6e6f35b818c0759f45b35e937
SHA512 5169e1692c59893735e6533117a401ecc2f31f0d37157c881f53467344384882b771f99f2557097261b425168fcb989009f7ed7b84620d9ecbddeaa0979b6702
SSDEEP 98304:6/mm/mm/mm/mm/mmEOU/jIEeQfoR/IuOFVjUu5m:6/mm/mm/mm/mm/mmEFIF0wuQ
TLSH
T17EE66C09F99244F1D967417049CBD27ECA70BA2186228EEBF74DC71B6F23B91AC39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2768-0-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download

memory/2768-8-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download

memory/3280-24-0x0000000000350000-0x0000000000371000-memory.dmp

Download

memory/3280-34-0x0000000000350000-0x0000000000371000-memory.dmp

Download