fcb113aa82df10729fe9d909afd48eaf940bccd07c4f4fd3e45750a4bd448c04

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_6cb1935bbdd8c2f63526c67e41f74e3f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 34.4MB
Sample260831-xmnprsem7w
SHA256 fcb113aa82df10729fe9d909afd48eaf940bccd07c4f4fd3e45750a4bd448c04
MD5 6cb1935bbdd8c2f63526c67e41f74e3f
SHA1 d4b510a1ac2e41d77005455a60ed249687eda8d8
SHA512 26186ba1386c3139896d381c7ee79b63fdf92c591bbc212d9211b3a042d1e784d456e05b8e1068266225bda3e22fe3ceb814329a22d7b6fb253e119e2e7fbfa5
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+Eo:tOU/jIEeQfoR/IuOFVjUu5P
TLSH
T1B2875C09F94340B1D92B11B04DCBD2BF8A70BA2587128EF7F64DDB1B7A33BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3240	svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe
4968	svchost_CAABABCBCBCBBABCBCACBABAACBBABCBAACCCBCBABACCBCBBBCBAAB.exe
5852	svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCABCCBABCCBBBCCAAAACABBBAACAAABBABACBACAABACCBCCAAAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe"	2026-08-31_6cb1935bbdd8c2f63526c67e41f74e3f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAACCBBACBBACBBCBCABBBCBCBAABCACBBBCABAAACCABCBAABCCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABABCBCBCBBABCBCACBABAACBBABCBAACCCBCBABACCBCBBBCBAAB.exe"	svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6056	sc.exe
4244	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3816	cmd.exe
5164	cmd.exe
3272	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABABCBCBCBBABCBCACBABAACBBABCBAACCCBCBABACCBCBBBCBAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_6cb1935bbdd8c2f63526c67e41f74e3f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3444	2026-08-31_6cb1935bbdd8c2f63526c67e41f74e3f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3444	2026-08-31_6cb1935bbdd8c2f63526c67e41f74e3f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3444	2026-08-31_6cb1935bbdd8c2f63526c67e41f74e3f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3444	2026-08-31_6cb1935bbdd8c2f63526c67e41f74e3f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3240	svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe
3240	svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe
3240	svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe
3240	svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe
4968	svchost_CAABABCBCBCBBABCBCACBABAACBBABCBAACCCBCBABACCBCBBBCBAAB.exe
4968	svchost_CAABABCBCBCBBABCBCACBABAACBBABCBAACCCBCBABACCBCBBBCBAAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	2026-08-31_6cb1935bbdd8c2f63526c67e41f74e3f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3240	svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe
Token: SeDebugPrivilege	4968	svchost_CAABABCBCBCBBABCBCACBABAACBBABCBAACCCBCBABACCBCBBBCBAAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 3816	3444	2026-08-31_6cb1935bbdd8c2f63526c67e41f74e3f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 3816 wrote to memory of 4612	3816	cmd.exe	94
PID 3240 wrote to memory of 5464	3240	svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe	95
PID 3444 wrote to memory of 5164	3444	2026-08-31_6cb1935bbdd8c2f63526c67e41f74e3f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 5164 wrote to memory of 6056	5164	cmd.exe	100
PID 3444 wrote to memory of 3272	3444	2026-08-31_6cb1935bbdd8c2f63526c67e41f74e3f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 3272 wrote to memory of 4244	3272	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-31_6cb1935bbdd8c2f63526c67e41f74e3f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_6cb1935bbdd8c2f63526c67e41f74e3f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCACAACAACCAABCCBACCBCCCBABCBCBBACCCBACBBAACBBCCAABCCCBBBAAAABAABABBCBCCCBCABBACACCACACABABCCACABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCACAACAACCAABCCBACCBCCCBABCBCBBACCCBACBBAACBBCCAABCCCBBBAAAABAABABBCBCCCBCABBACACCACACABABCCACABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCACBACAAABBCCBCCACABBCACBCBCCCACCBACCBCCCCBBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe" start= auto displayName= "UserDataSvc_CBACCACBACAAABBCCBCCACABBCACBCBCCCACCBACCBCCCCBBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACCACBACAAABBCCBCCACABBCACBCBCCCACCBACCBCCCCBBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe" start= auto displayName= "UserDataSvc_CBACCACBACAAABBCCBCCACABBCACBCBCCCACCBACCBCCCCBBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCACBACAAABBCCBCCACABBCACBCBCCCACCBACCBCCCCBBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACCACBACAAABBCCBCCACABBCACBCBCCCACCBACCBCCCCBBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4244

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABCBCBCBBABCBCACBABAACBBABCBAACCCBCBABACCBCBBBCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABCBCBCBBABCBCACBABAACBBABCBAACCCBCBABACCBCBBBCBAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4968

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe
1⤵
- Executes dropped EXE
PID:5852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 529bb8ed0a2efb0b96122cb48bf6ad55de3449c90e80d2cd0a6747326a365b64
MD5 17e03992efaf5dd520edf21b2fd3b66e
SHA1 ca122f0b4105c6edc2c34c6e312ac56ac2d7e79f
SHA512 2ef5ea4a2284401be43eaed67e408d0127012cd5b1ed923416a2abfbab15c9fbcf70eab9dd54f84ce9dfb7b872287c89dd0db3cad46a00682655e72d82d5a160
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f54f7e33c2b1d728949ce6f437ed9408d0d8c96842ea84a8b9c650101301d5e7
MD5 085b3690411f849c840a86a57f55cc00
SHA1 7d04b4ac11f1cbb0002ba65a4e98a7a4892428f3
SHA512 226467443cd2dfc215566598ccd1a75a1a2c397125e19d8d003963b4136804882c4dbbf5d15a5effa3c21e99e0c7eb90c2431fdc51c79020812c5d4b12e49bb5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ef1d6c50939a57ebcca1e67318973f783b5ece36e12a5013b13a6b5134a03c60
MD5 e62265d6e13037ac7d49faf5b1f83c16
SHA1 4952f50885e467f05586b92b7f13646dbe2d56ed
SHA512 a6862f7761db90be689a95ede77782885e7ce631b1e3bf71d36a7059b15af7f806d4d0fea82bbb6acf6d95b4a7c59ff11dd6f0fdc70307321a82133ada0bd629
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 46c331cbab626ce256c8cdb2564d882372f902564415d8da8691c78e13a65587
MD5 4b4c8941a6e194f070132aaf090ef83c
SHA1 d9fe236d4d6b49d45f927110604940d79f14a344
SHA512 c10d511092cb91aa1091b0df9aebdd4050be6b10e63735ff8c6cc1ad94feb86fe0163160cf4450ec433f7f64cdb9571207d29e6f11ff1f670a68882f17ecf150
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 32e7b79e9c2475e8ffdf57e3b7e49f20284e4615c214749fd75b760ee1388afa
MD5 b314c8e67b4a33f50ca1c0f8b306f122
SHA1 49996103c10d34b49c9da7a539b89885be761e51
SHA512 830d41c53e9e82652faeff8b3f36452c3d8fa68536e24c3fb28202f0a06e0c63ad0037b66a33a5be79918d390f5e6633fcb1c0dbf8f691a0b5bf227269e1c59b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5a85b7e2a4a8c03188520182669b50a985daa825c14e952fb1cc963d9b6786c2
MD5 d27e1a3914098a3ce7f6330f2090912c
SHA1 bf5386e5635dd90f46a2ea182c716686deb019f4
SHA512 e92acc265d9c93d2689404a01f2f671f85d229387b999ff26f137026966a92917078004f8df5ba18eaee2de5ef2522fc9bca5f03deaf8f7072cf2141704ce58f
MD5 SHA1 SHA512

Submit Download

svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBABACBCAABACAACBAACCACCCABAACAABABCABBCBCBAABABCC.exe
Size 34.4MB
SHA256 fcb113aa82df10729fe9d909afd48eaf940bccd07c4f4fd3e45750a4bd448c04
MD5 6cb1935bbdd8c2f63526c67e41f74e3f
SHA1 d4b510a1ac2e41d77005455a60ed249687eda8d8
SHA512 26186ba1386c3139896d381c7ee79b63fdf92c591bbc212d9211b3a042d1e784d456e05b8e1068266225bda3e22fe3ceb814329a22d7b6fb253e119e2e7fbfa5
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+Eo:tOU/jIEeQfoR/IuOFVjUu5P
TLSH
T1B2875C09F94340B1D92B11B04DCBD2BF8A70BA2587128EF7F64DDB1B7A33BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 fc0040aae093386cfb4c193df5044afbe0c32dd60f06235a1d0f13361fca45b3
MD5 0ec19e641784f6985d0667e1253e8232
SHA1 8db93b120fb33e9b74935dbddf2bc8fa9726857c
SHA512 2a1e6117e2de4a66fe2ef3013a29d3a4273ff2c2971237df808fbca95f78551b9d235834dab4710e3382dbbd32ef27a838ad875ff1bf7a1b90d68372e2130604
TLSH
T1EB112320E0F9CC93F63238CA9529E9D718E4325B589CAF04330A0218E3BDC258D254F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3240-32-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/3444-0-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/3444-8-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/4968-79-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download