57ce391a847c52b9c61fc51dbdbd314ad67b1b4b13a56931c509c742250d2f8c

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_0579a3999e222bf5295ff2e48a8d2cdf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 20.7MB
Sample260901-152wwsfa57
SHA256 57ce391a847c52b9c61fc51dbdbd314ad67b1b4b13a56931c509c742250d2f8c
MD5 0579a3999e222bf5295ff2e48a8d2cdf
SHA1 0fee6e349f8213c979acd8f6793f3af31bdf9c87
SHA512 5f753f31c3debe5142d04c5f25d09b52c392915b9dd976599e91f6e6bb6fcfae456d725cee500330238a0fcb0154b0378af0d77096090a950017aa89d0d39af5
SSDEEP 49152:U+En+En+En+En+En+En+En+Ez+En+En+En+En+En+En+En+En+En+En+Ez+En+E8:KOU/jIEeQfoR/IuOFVjUu5Y
TLSH
T19B273B09F94340B1D92B51B04DCFD3BF8A60BB2583128EF7FB4DCB5B6922BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3168	svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe
3260	svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe
5596	svchost_BACBAAACCCCBBAAAAACCCAACBACAABACACACCAACBABBBABBACABAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBCCCAACABAAAACABBCCBABCCACBAABCABACABABCBACABBBACACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe"	2026-09-01_0579a3999e222bf5295ff2e48a8d2cdf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACBBCACACBABABAACABAACCCCAACBCCBACCCBBCBBAABAAAAACCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBAAACCCCBBAAAAACCCAACBACAABACACACCAACBABBBABBACABAAB.exe"	svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3844	sc.exe
1488	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2384	cmd.exe
3924	cmd.exe
4244	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_0579a3999e222bf5295ff2e48a8d2cdf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBAAACCCCBBAAAAACCCAACBACAABACACACCAACBABBBABBACABAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3252	2026-09-01_0579a3999e222bf5295ff2e48a8d2cdf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3252	2026-09-01_0579a3999e222bf5295ff2e48a8d2cdf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3252	2026-09-01_0579a3999e222bf5295ff2e48a8d2cdf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3252	2026-09-01_0579a3999e222bf5295ff2e48a8d2cdf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3168	svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe
3168	svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe
3168	svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe
3168	svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe
5596	svchost_BACBAAACCCCBBAAAAACCCAACBACAABACACACCAACBABBBABBACABAAB.exe
5596	svchost_BACBAAACCCCBBAAAAACCCAACBACAABACACACCAACBABBBABBACABAAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3252	2026-09-01_0579a3999e222bf5295ff2e48a8d2cdf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3168	svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe
Token: SeDebugPrivilege	5596	svchost_BACBAAACCCCBBAAAAACCCAACBACAABACACACCAACBABBBABBACABAAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 2384	3252	2026-09-01_0579a3999e222bf5295ff2e48a8d2cdf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	91
PID 2384 wrote to memory of 2648	2384	cmd.exe	93
PID 3168 wrote to memory of 3868	3168	svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe	94
PID 3252 wrote to memory of 3924	3252	2026-09-01_0579a3999e222bf5295ff2e48a8d2cdf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	95
PID 3924 wrote to memory of 3844	3924	cmd.exe	97
PID 3252 wrote to memory of 4244	3252	2026-09-01_0579a3999e222bf5295ff2e48a8d2cdf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 4244 wrote to memory of 1488	4244	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-09-01_0579a3999e222bf5295ff2e48a8d2cdf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_0579a3999e222bf5295ff2e48a8d2cdf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBBCABCBCBBCBBACAAACCAABBCBCBBCBAAACBCBCABCAAABCCAABCCAABACBCACBBABACCCAABBABBBACBCACBBBACACABAACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBBCABCBCBBCBBACAAACCAABBCBCBBCBAAACBCBCABCAAABCCAABCCAABACBCACBBABACCCAABBABBBACBCACBBBACACABAACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCCCBBACCCABCCCBCAABAAACACBBCBABAABABBACABBCCCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe" start= auto displayName= "UserDataSvc_CBCCCCBBACCCABCCCBCAABAAACACBBCBABAABABBACABBCCCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCCCBBACCCABCCCBCAABAAACACBBCBABAABABBACABBCCCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe" start= auto displayName= "UserDataSvc_CBCCCCBBACCCABCCCBCAABAAACACBBCBABAABABBACABBCCCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCCCBBACCCABCCCBCAABAAACACBBCBABAABABBACABBCCCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCCCBBACCCABCCCBCAABAAACACBBCBABAABABBACABBCCCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe
1⤵
- Executes dropped EXE
PID:3260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAAACCCCBBAAAAACCCAACBACAABACACACCAACBABBBABBACABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAAACCCCBBAAAAACCCAACBACAABACACACCAACBABBBABBACABAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ebc5850b67260793cf351b4612a2d52fe7cbfcf14ac8f3c20a42938ea2763b25
MD5 76b63a0ed6cbf2c327c8b0f947e6c3e4
SHA1 84254bb3a1234db160c6b837e1aa663b6b25d29d
SHA512 3321e832155297746cdb7d5f06db96c1a85ddc6841dab795f0584f081533418ae66a9af13ef00f4903d6d74158b18f131900e85a6b9514bbb19567e2fc1fe286
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f3ca8e9334ca1080666b761dad6efdc2464e483cf46eb1cf3cb55f9de6594c94
MD5 c398179cc74b97a4f8e2504335c76452
SHA1 24da4ed18aa177c216627acb1ac815f2ddac361c
SHA512 d9fd9e1e94dcfda10673e98cc3b3fe7ea94c84771e3eb4af9b9b939f7dcb776f94fe67d544305683488df53075fa7a85a660aa5f125e3b98171c80bafcf14a31
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 40670f82ce42eca4abca5a1c7ab8649b7370c3c6debd7a3a113ee4130faacf52
MD5 9f3142d16dd2ee2d4ea4ca9389e93aa6
SHA1 b1e1ddf826b4cd0dd6c52857cefaa672e8073916
SHA512 57a93ce15ebbbfd1a3a0e3d281a08d4615dacdbf4cf55fd629980afb0f38a1369fa4fc3a41b3abe8314363c8abb994d834b6aad95b48fc4c72dadb87a881c654
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5fba67b4657cb163749052faac61521ca039a6ed56b1b0a7f7363a9f6ca94f24
MD5 3a2e0aeddd4c11a6c7f8325230b5a634
SHA1 0b39bb429eb698eec69b4057ab80fcab6559dc79
SHA512 b6e3494bbe11d6abe117916f9d755a24035650b942fa8dda61e2286dc2942f7fb55ff3c4e459d97cebf23dc6b771174080213c89b3003be3a310922d66dc4559
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8e0ebcae8f00a11be4eac63fefe7dde07eefbee9d6c30ceaa502d0a286799151
MD5 b71692a43ec03dd7e46a9a2aa5ca25fc
SHA1 cbff741cc4296a1130ba57968760a9e1f0491713
SHA512 c0f23345b61af2d8735e97cad99a87594f94a6a5fbbb7e7f5fef056b265972ebce32d82b423ca7c50abe30e16fe2f28c85ea76fc14211d45a06470fce3230d82
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7997a59b4f449d62067a1d6d826fc77b24173e78c3189643de09392456ccb40a
MD5 12777f3eace6462b707c93c5a46e7093
SHA1 68ff5f600df0cc2bb13a708bbcedf14177ae8332
SHA512 da24ae47085cd671a6ac6588c23f7f63a2503c3af89db3b4a31cdbb1fc2852cfde268762b288a342e5fb949a21a565c94d670b88b548cdffc5cef359e0e42603
MD5 SHA1 SHA512

Submit Download

svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACABABBBBACBBBCABBAAAAABABBCCACCACACCBBBAAAACABCBCAA.exe
Size 20.7MB
SHA256 57ce391a847c52b9c61fc51dbdbd314ad67b1b4b13a56931c509c742250d2f8c
MD5 0579a3999e222bf5295ff2e48a8d2cdf
SHA1 0fee6e349f8213c979acd8f6793f3af31bdf9c87
SHA512 5f753f31c3debe5142d04c5f25d09b52c392915b9dd976599e91f6e6bb6fcfae456d725cee500330238a0fcb0154b0378af0d77096090a950017aa89d0d39af5
SSDEEP 49152:U+En+En+En+En+En+En+En+Ez+En+En+En+En+En+En+En+En+En+En+Ez+En+E8:KOU/jIEeQfoR/IuOFVjUu5Y
TLSH
T19B273B09F94340B1D92B51B04DCFD3BF8A60BB2583128EF7FB4DCB5B6922BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 676a5fe19f8969f6d98bcb213d1a3c05d77e062576b8cb1a97128b0593497882
MD5 f1a30aaa113d58f4b6fcbf0a82339107
SHA1 b717dc24f9958bc06a5264e7b1b398ff6022ef5e
SHA512 4c8d28cfc3c427cf836eb3eeedab15beaef369a8fda79ec5a044fb61668ffda8a8726e4de5b7ca43208c555fbd2e53ec3b834eafefcbab12fe9f768e604249b0
TLSH
T1BC114661E0F5D853F13328C2D226ABC70CD53B8FAC6CAB1C2A8D531D764587A8F194B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3168-36-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/3168-23-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/3252-0-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/3252-7-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/3260-76-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/5596-81-0x0000000000190000-0x00000000001B1000-memory.dmp

Download