ac2f65f5c43c92f26678c814259226283d0fd94ebf13f1da14bdf81c731d2839

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_fed02ccc1933105171f22e4886a12bcd_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 16.8MB
Sample260901-2kr2mafa97
SHA256 ac2f65f5c43c92f26678c814259226283d0fd94ebf13f1da14bdf81c731d2839
MD5 fed02ccc1933105171f22e4886a12bcd
SHA1 d08d35b7fe77f2db24b023fe07a91b8ee33ce31a
SHA512 ee94dec9d62d913677670ba22d080a989110d7db7160771460bbda459df9dee6a3fd551d9ae99d466c512ec2a1a9f46d767663a1d1e9f1e6feef9d5fa814761d
SSDEEP 49152:U+ES+EzD+Es+ES+EUhO7+Es+ES+Es+ES+EzD+Es+ES+EN+Es+ES+Es+ES+EzD+EZ:mVVVVVVVVOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1A6074C09F98740B1E87751B04DDBD2BF8930BA2187228DEBF64DC61BAA33BD19834755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4108	svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe
1156	svchost_CBAABCABCBACABBAACACBAAABCABCACCCCCCBBAAAABCACCCACAAACB.exe
2340	svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCCBACCCBCAABCCBAABCAAACACBAAAACCAABABCACCAAAACAACABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe"	2026-08-31_fed02ccc1933105171f22e4886a12bcd_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCAAAAAABBCCACCBBBBCABCBBCABACABCCBAAACBCBACBBCBCBCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAABCABCBACABBAACACBAAABCABCACCCCCCBBAAAABCACCCACAAACB.exe"	svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4324	sc.exe
4480	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1668	cmd.exe
2408	cmd.exe
4424	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAABCABCBACABBAACACBAAABCABCACCCCCCBBAAAABCACCCACAAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_fed02ccc1933105171f22e4886a12bcd_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5800	2026-08-31_fed02ccc1933105171f22e4886a12bcd_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5800	2026-08-31_fed02ccc1933105171f22e4886a12bcd_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5800	2026-08-31_fed02ccc1933105171f22e4886a12bcd_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5800	2026-08-31_fed02ccc1933105171f22e4886a12bcd_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4108	svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe
4108	svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe
4108	svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe
4108	svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe
1156	svchost_CBAABCABCBACABBAACACBAAABCABCACCCCCCBBAAAABCACCCACAAACB.exe
1156	svchost_CBAABCABCBACABBAACACBAAABCABCACCCCCCBBAAAABCACCCACAAACB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5800	2026-08-31_fed02ccc1933105171f22e4886a12bcd_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4108	svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe
Token: SeDebugPrivilege	1156	svchost_CBAABCABCBACABBAACACBAAABCABCACCCCCCBBAAAABCACCCACAAACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 1668	5800	2026-08-31_fed02ccc1933105171f22e4886a12bcd_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 1668 wrote to memory of 4184	1668	cmd.exe	94
PID 4108 wrote to memory of 972	4108	svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe	95
PID 5800 wrote to memory of 2408	5800	2026-08-31_fed02ccc1933105171f22e4886a12bcd_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 2408 wrote to memory of 4324	2408	cmd.exe	100
PID 5800 wrote to memory of 4424	5800	2026-08-31_fed02ccc1933105171f22e4886a12bcd_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 4424 wrote to memory of 4480	4424	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-31_fed02ccc1933105171f22e4886a12bcd_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_fed02ccc1933105171f22e4886a12bcd_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCABCBBAAABBACCABCABBBAACBACACCCCBBAACBACBBBACCBBBBCCBCBCBBBBCAAABABAABBBABCCCCCBBBAACBCBCBCBCBBBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCABCBBAAABBACCABCABBBAACBACACCCCBBAACBACBBBACCBBBBCCBCBCBBBBCAAABABAABBBABCCCCCBBBAACBCBCBCBCBBBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCCBCBACABBAAABBCACAABBAAAABABBCCCBABCCBBBAACACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe" start= auto displayName= "UserDataSvc_CCBCCBCBACABBAAABBCACAABBAAAABABBCCCBABCCBBBAACACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCCBCBACABBAAABBCACAABBAAAABABBCCCBABCCBBBAACACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe" start= auto displayName= "UserDataSvc_CCBCCBCBACABBAAABBCACAABBAAAABABBCCCBABCCBBBAACACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCCBCBACABBAAABBCACAABBAAAABABBCCCBABCCBBBAACACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCCBCBACABBAAABBCACAABBAAAABABBCCCBABCCBBBAACACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCABCBACABBAACACBAAABCABCACCCCCCBBAAAABCACCCACAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCABCBACABBAACACBAAABCABCACCCCCCBBAAAABCACCCACAAACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe
1⤵
- Executes dropped EXE
PID:2340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 748639da5b22af6b4b2277dacaa5c5294d08669ea7c57433bd04e8a40c69b75f
MD5 bef48947906f2b0337f309997c02c1f1
SHA1 f0688320690264cb5e3e871813f9c2a40df58e4a
SHA512 dffe3f8faa453e110e8dc210ff3997126c1c5e81343f94e34fc63a60ec7afcecdb985f370b85442e9d954f35e453818db4fb728e7ecf7b590ed4823d1063217a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 19987ef64884210c6841af208ad1aaf1ea0d6651fa65d01442c5d9dae7c75153
MD5 ebc96d494eb42dec5cf1e15dbf2acbda
SHA1 17a5976977340ab6339eb7ee58e462448882c083
SHA512 5df156fc8b1c6a80810a179540170aa6e9e46f7443e1e69c522d32391c1bab0f900244469242032f3ce23bf68b065fee0c326644c10d6a9e949be9573217c5e4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1f653cb43e216458e0375940b2021933bf079ccd10fce186f2bef9b559fe6cf7
MD5 96d3a6802ca9547f83f5a4503118ede8
SHA1 4b60c8be97a1bbcb1e95cea4f15657907da6e0e3
SHA512 f07cea4d4042889f8670bf2d56296c9dcb848a5acfb467d7407b10eddea4deedb1f8b0923826fcd33e39c98865aead22d10de4beda2dd1497b5f2f514ed1fa8f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41027af0e539d7158faf6b6f60084c7594894d271f771df94152800b28cc7915
MD5 0c94105d8304bfcbf6f0103e450903b3
SHA1 83204c3d7430358a7cbfc7eed47d896875bb2497
SHA512 c45624c7452d38b9aed876f2641b937bdb2c0c56528f8a8ffdd708b144650f044a196c7e0503d7815a64284a6ec57821f6a038d3c2db6ef74622621106739a83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0ac2508520f91eb15d9e3b96d5c56960fad2254edb76a93fbc0730008c56b59e
MD5 b0b93b78288129a14bef04a4222ff96e
SHA1 7b7561b372ad13ee5d704d51d61a5e927255ffcc
SHA512 d31c779458bc15862236e685558734c2de810c9bd93220bca467b11c551a2740c4ca0fea51bee7acbba521f7a4ce66fe3f0af4e79a6c7c23b068075e1ccac2da
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1c5f4c105b3670ed45bc428fa4aac4c7cdda964d1daf0987b5af495d0bf97a47
MD5 e2b214b6fcece523e07b99b32f981c3d
SHA1 405d96e0eff61fb368f6ed4f93f9cd59733f749f
SHA512 95e4804944424dfe4dd54b5d807ee80ddf2e6e1f97804a9beecff9841a73efdc0aff7be2f60cb31872755fcc674371872eeb29028473c29ee77548536c8d3b5f
MD5 SHA1 SHA512

Submit Download

svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBBCABAACCAAAABACCCAAACAAABBBAACBABBACCCBCCABBCBAC.exe
Size 16.8MB
SHA256 ac2f65f5c43c92f26678c814259226283d0fd94ebf13f1da14bdf81c731d2839
MD5 fed02ccc1933105171f22e4886a12bcd
SHA1 d08d35b7fe77f2db24b023fe07a91b8ee33ce31a
SHA512 ee94dec9d62d913677670ba22d080a989110d7db7160771460bbda459df9dee6a3fd551d9ae99d466c512ec2a1a9f46d767663a1d1e9f1e6feef9d5fa814761d
SSDEEP 49152:U+ES+EzD+Es+ES+EUhO7+Es+ES+Es+ES+EzD+Es+ES+EN+Es+ES+Es+ES+EzD+EZ:mVVVVVVVVOU/jIEeQfoR/IuOFVjUu5m
TLSH
T1A6074C09F98740B1E87751B04DDBD2BF8930BA2187228DEBF64DC61BAA33BD19834755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a76af2538a2721ffcf0bff4b76fe1220ca6faa6197094c7e95790d54be808244
MD5 f6900590f1041f114f00c5c05d9d0fc6
SHA1 662970f93523c58e568e46d4d7050f550f34d9f6
SHA512 f543a1c94121fed25adb3b4b795ca83e2065ae06a60e895720f6928f75d8c351fc8562da5e6de35cde8c5e67f4ca83093577b8b5d9444fcb0b3f351279ea98da
TLSH
T11211C851E0F5D813F1222C9B9525EF8B0CB23BCFAC5CAB9C965C0718A689C7DCD154B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1156-79-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/4108-34-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/4108-24-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/5800-0-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/5800-8-0x0000000000040000-0x0000000000061000-memory.dmp

Download