ad7339ef9be80ab0dddc24401080cfb6a8ae7510163fa2ae8cd7973ad9adb61c

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_a56080face9753f023449ad4a649f19e_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
Size 28.5MB
Sample260831-ts2a9swbpc
SHA256 ad7339ef9be80ab0dddc24401080cfb6a8ae7510163fa2ae8cd7973ad9adb61c
MD5 a56080face9753f023449ad4a649f19e
SHA1 31f8bbd6a61022338579a55d4f904fc9b7c5df24
SHA512 d4d502b539e0193436eeb7a5b69d2fb45902ecee73e6fc3799cd47ee09c4136b9fc097ef2b90907b2760a1b9e286a96bc778a5d3b04e80e458b64cc2fc21ab62
SSDEEP 196608:LhgZ2jXhgZ2jXhgZ2jXhgZ2jXhgZ2jXhgZ2jXhgZ2jNnSL:Y2I2I2I2I2I2I2Jg
TLSH
T168675C05FA85C472E97601714C9B83FA6630BD214F018AEBB7C8B37E5E337D0A636659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c58f-19.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3412	svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe
6004	svchost_BCBABBAABBBCBACBBBAAAACBCBABCBCAABCBBBCBABBACABBACACCAC.exe
1228	svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCCBCCBAAAACCBCBBCBBCCCABCCCCABBBABBABAABACCBBCBBBBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe"	2026-08-31_a56080face9753f023449ad4a649f19e_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBAABCCBBABACBAACCABCABBBCABABCCBBCBAAACCCCBBBABCCCBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBABBAABBBCBACBBBAAAACBCBABCBCAABCBBBCBABBACABBACACCAC.exe"	svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3764	sc.exe
3752	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4772	cmd.exe
4768	cmd.exe
3268	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBABBAABBBCBACBBBAAAACBCBABCBCAABCBBBCBABBACABBACACCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_a56080face9753f023449ad4a649f19e_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
716	2026-08-31_a56080face9753f023449ad4a649f19e_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
716	2026-08-31_a56080face9753f023449ad4a649f19e_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
716	2026-08-31_a56080face9753f023449ad4a649f19e_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
716	2026-08-31_a56080face9753f023449ad4a649f19e_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
3412	svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe
3412	svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe
3412	svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe
3412	svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe
6004	svchost_BCBABBAABBBCBACBBBAAAACBCBABCBCAABCBBBCBABBACABBACACCAC.exe
6004	svchost_BCBABBAABBBCBACBBBAAAACBCBABCBCAABCBBBCBABBACABBACACCAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	716	2026-08-31_a56080face9753f023449ad4a649f19e_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	3412	svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe
Token: SeDebugPrivilege	6004	svchost_BCBABBAABBBCBACBBBAAAACBCBABCBCAABCBBBCBABBACABBACACCAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 4772	716	2026-08-31_a56080face9753f023449ad4a649f19e_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe	92
PID 4772 wrote to memory of 5540	4772	cmd.exe	94
PID 3412 wrote to memory of 2532	3412	svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe	95
PID 716 wrote to memory of 4768	716	2026-08-31_a56080face9753f023449ad4a649f19e_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe	98
PID 4768 wrote to memory of 3764	4768	cmd.exe	100
PID 716 wrote to memory of 3268	716	2026-08-31_a56080face9753f023449ad4a649f19e_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe	101
PID 3268 wrote to memory of 3752	3268	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-31_a56080face9753f023449ad4a649f19e_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_a56080face9753f023449ad4a649f19e_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAAAAABCACCAACAABBCBCABBBBABBBBCBABAACBACAAAAACCCACBAACABACAACCBABCCAABBBBBBCACCBCCAABBCCABCBCACCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAAAAABCACCAACAABBCBCABBBBABBBBCBABAACBACAAAAACCCACBAACABACAACCBABCCAABBBBBBCACCBCCAABBCCABCBCACCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCBCCCACABBCAABBBABBBBBBBBAACABBCABCAAAACCABBACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe" start= auto displayName= "UserDataSvc_ACBCBCCCACABBCAABBBABBBBBBBBAACABBCABCAAAACCABBACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCBCCCACABBCAABBBABBBBBBBBAACABBCABCAAAACCABBACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe" start= auto displayName= "UserDataSvc_ACBCBCCCACABBCAABBBABBBBBBBBAACABBCABCAAAACCABBACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCBCCCACABBCAABBBABBBBBBBBAACABBCABCAAAACCABBACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCBCCCACABBCAABBBABBBBBBBBAACABBCABCAAAACCABBACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3752

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABBAABBBCBACBBBAAAACBCBABCBCAABCBBBCBABBACABBACACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABBAABBBCBACBBBAAAACBCBABCBCAABCBBBCBABBACABBACACCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe
1⤵
- Executes dropped EXE
PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eb008dc6ee0c21178932660f59794415a1d6fc17acf1c8b297e6ce0651b19f9b
MD5 26c8a9c9f809419e3548f2b5a45a88bb
SHA1 b1065543fc519e143ba2c45fe4f3364efd70b9e0
SHA512 c06c8c9468a06b63ca03f6e8b328f22114110011e898ccc492a3ea1849c54e030db17d31aa3ad0e4f700a22b0e485423019cbea11fc236187be6babe6cd58d93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d91f493c95fee105cd6aca7a60617a44f4bdc715c8bfe954de29f4309ccefcf7
MD5 9fc3acfacee994a43b8206392b98b576
SHA1 3e8bdac8d7f5b428512feb395d2a0565370d9a45
SHA512 b99563f0a82f6abc9714b312da457cfc886385c47881d908542479f1896c5d781b2e8e07d1413a3c3dd21c28992beb7e79d593b81a03b571b07e85ed69b59dc7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 59b62b8102581eababc8e57b8e19fef71b2c62c50be341234ab3543922826ff9
MD5 9abad1fc99fd95158c650c182dd644a6
SHA1 dd4c552bd493737df2d29c7648996f6e407540b6
SHA512 214fe562d5dd4e6221941859ee9288b6514c30104cfa7d1d8b859dc69e1827e2ae4e50b6cac96fe63abe6c7ca407f15ede095840b6eb5d12fbd81e5fd30e79b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 698cd7bac2e556f0a8a412ccacdf3ddd39cc410d370e9df0b1bd95ca34cb2386
MD5 8b2051018b50024dbd5676a1bea2e42f
SHA1 7219d72e3b5f1de7cf56eb6b1c1d4fa2f29d73bf
SHA512 4e6bb51e3718ec28f6da9770185ce3ecb05d51f191c90b5c41cfb9f35fbe481c4371828ab38f8871aebdc33484c0cf88546635f5594af6915e139ad1d02f9380
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bb379fc6167650a534d560a68fcbf17653ac3259043829c09e59311a694b1bf0
MD5 dd62103e1e4f213722e3c788ad2b9337
SHA1 4815bc3dee6040ed0c13bc6ab6baf0abd0f9358a
SHA512 687ad7b56bcfbab831a6c859ff2c69bfea0219f5e989e67a66d21d90be88810f0aa914b74f8d3b98bd6086ac0eee0db6489e10bd761dd481b84367efbfef6c01
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8a7eb2408839b3298be3fd5fa9b2f2d26ae981a55e764f8cec56397875e9e80d
MD5 989b1a6b1cf65f0df40f5c200c47849c
SHA1 f1f4a017dd90248207809256bb4c702afad295c2
SHA512 e80cc4e1ceff960d674476ae31c87f255af9b320512333863d27a41deb95897543e56ad1451a7e1d0ee1ee448251727bcf38d8518c986f07fc36038c77f3b290
MD5 SHA1 SHA512

Submit Download

svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAABBCBCCBBACBCBABAAAABCABBCCAABCCBCCBCACABABACBCBCA.exe
Size 28.5MB
SHA256 ad7339ef9be80ab0dddc24401080cfb6a8ae7510163fa2ae8cd7973ad9adb61c
MD5 a56080face9753f023449ad4a649f19e
SHA1 31f8bbd6a61022338579a55d4f904fc9b7c5df24
SHA512 d4d502b539e0193436eeb7a5b69d2fb45902ecee73e6fc3799cd47ee09c4136b9fc097ef2b90907b2760a1b9e286a96bc778a5d3b04e80e458b64cc2fc21ab62
SSDEEP 196608:LhgZ2jXhgZ2jXhgZ2jXhgZ2jXhgZ2jXhgZ2jXhgZ2jNnSL:Y2I2I2I2I2I2I2Jg
TLSH
T168675C05FA85C472E97601714C9B83FA6630BD214F018AEBB7C8B37E5E337D0A636659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f22bbd44a719de5f2f70d6714b7ea935d0c7e455ce804e28fa72f9082988e945
MD5 5996252dfd6d8422f55d369edfcf7031
SHA1 db1418b8d01252a5e3f4d8f315fe7c843fad1707
SHA512 5032e41b812aa53dc207eda55ae755c8c2635aca7b118da950054bf300fa4c4541cd5563059ac8f69918737d85fb242dc3d96155dd8484e580db89eb263a141f
TLSH
T1981127A5D0E6DCD3E833288BD311EDC70CD83187989C7AA167194118A7CD8319E1E8E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/716-7-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/716-0-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/1228-80-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/3412-34-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/3412-24-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/6004-70-0x0000000000430000-0x0000000000451000-memory.dmp

Download