59aa041c4768a78c90d2b5cc54e49790b6824ffbd894eeb3a3c34c64539e2815

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 19:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_300b4fa3ef8ffdff13ffa77df8222bd7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 21.0MB
Sample260901-yqmsbaee96
SHA256 59aa041c4768a78c90d2b5cc54e49790b6824ffbd894eeb3a3c34c64539e2815
MD5 300b4fa3ef8ffdff13ffa77df8222bd7
SHA1 bce879daf5ac2e613e3f9aa2d7e3b6bc1ac06ce1
SHA512 1936a1e6610f84b65b5672e683ff774594109f28bcb5ef6e840a47016066853203d06cd3729c3a654e2e3c52b6807abc6eedd5d7d89e79b637aca09d50392ba4
SSDEEP 49152:U+ES+ES+ES+ES+ES+ET+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+EJ:LOU/jIEeQfoR/IuOFVjUu5f
TLSH
T1C9273B09FD4344B1D92B51B04DCFE3BF8A60BB2582128DF7FB4ECB5B6523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4124	svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe
5336	svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe
1408	svchost_CCACBCBABCAAACCBCAACCBCCACCBBBBBABACBBBABCCACCCBACBCBCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCBACCCABCACBACBACAAABBACABBBAACCCCBABABBBBACBBBBBBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe"	2026-09-01_300b4fa3ef8ffdff13ffa77df8222bd7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAACABBBABABACCAACCAACCCCACBBBCBACBBCCCBACBCCBBAACAABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACBCBABCAAACCBCAACCBCCACCBBBBBABACBBBABCCACCCBACBCBCB.exe"	svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4300	sc.exe
5156	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2100	cmd.exe
4384	cmd.exe
4840	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACBCBABCAAACCBCAACCBCCACCBBBBBABACBBBABCCACCCBACBCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_300b4fa3ef8ffdff13ffa77df8222bd7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4264	2026-09-01_300b4fa3ef8ffdff13ffa77df8222bd7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4264	2026-09-01_300b4fa3ef8ffdff13ffa77df8222bd7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4264	2026-09-01_300b4fa3ef8ffdff13ffa77df8222bd7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4264	2026-09-01_300b4fa3ef8ffdff13ffa77df8222bd7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4124	svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe
4124	svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe
4124	svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe
4124	svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4264	2026-09-01_300b4fa3ef8ffdff13ffa77df8222bd7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4124	svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 2100	4264	2026-09-01_300b4fa3ef8ffdff13ffa77df8222bd7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	96
PID 2100 wrote to memory of 5868	2100	cmd.exe	98
PID 4124 wrote to memory of 3396	4124	svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe	101
PID 4264 wrote to memory of 4384	4264	2026-09-01_300b4fa3ef8ffdff13ffa77df8222bd7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	102
PID 4384 wrote to memory of 5156	4384	cmd.exe	104
PID 4264 wrote to memory of 4840	4264	2026-09-01_300b4fa3ef8ffdff13ffa77df8222bd7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	105
PID 4840 wrote to memory of 4300	4840	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-01_300b4fa3ef8ffdff13ffa77df8222bd7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_300b4fa3ef8ffdff13ffa77df8222bd7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCABAAACCACCAAAAACCAABAACCACCAACBCBCACBAABCBBABBBBABABBCCBABBBCCAABBBACABBABBCBBCCBACBBCCCBBAACBBCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCABAAACCACCAAAAACCAABAACCACCAACBCBCACBAABCBBABBBBABABBCCBABBBCCAABBBACABBABBCBBCCBACBBCCCBBAACBBCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCAACBBBBCACAAACBCACACBCBBCABABBBBBBCBBCBCBBABCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe" start= auto displayName= "UserDataSvc_CBCAACBBBBCACAAACBCACACBCBBCABABBBBBBCBBCBCBBABCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCAACBBBBCACAAACBCACACBCBBCABABBBBBBCBBCBCBBABCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe" start= auto displayName= "UserDataSvc_CBCAACBBBBCACAAACBCACACBCBBCABABBBBBBCBBCBCBBABCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCAACBBBBCACAAACBCACACBCBBCABABBBBBBCBBCBCBBABCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCAACBBBBCACAAACBCACACBCBBCABABBBBBBCBBCBCBBABCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4300

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe
1⤵
- Executes dropped EXE
PID:5336

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBCBABCAAACCBCAACCBCCACCBBBBBABACBBBABCCACCCBACBCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBCBABCAAACCBCAACCBCCACCBBBBBABACBBBABCCACCCBACBCBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RedoInstall.exe

Path C:\Users\Admin\Desktop\RedoInstall.exe
Size 42.9MB
SHA256 65f8999470279a68ab50740d1d919959f0c9df7e794679576b4d9c5e0f18b634
MD5 a44236654a2018e50538b21d1a770183
SHA1 2f617da530255df7b163f8c49d6ed15b5d2e4890
SHA512 069b5d7504cf7aebe4970dd51e808d0fb2fa619dd916994cffd1eea116cd284ab6061f557653600fc964ae7b5b1c7a18b117a4176d13ed8f9647a4a07ccea6b7
SSDEEP 98304:LOU/jIEeQfoR/IuOFVjUu5DOU/jIEeQfoR/IuOFVjUu5e54hLNOhViyne:LFIF0wuxFIF0wuggLE7Pe
TLSH
T1D6A73B09FD4344B1D92B51B04DCFE3BF8A60BB2582128DF7FB4ECB5B6523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 28b792dc52c375b5883f10b2285ac7a5c43f5dbf2bcc9f518a66f9e4db6188b4
MD5 f96213c39f08034ca77b9ef3c55850eb
SHA1 3fa6a3301058f0119d003597d0ba76adc267d834
SHA512 22db6bc81bebe4f2e0a79ec960f9dca00f53d295fdc182bbce7c591b1a76729ee2f63917682be3a05d2ec6c89ec21768ee16619fa8ef26d1bbe1674a86d6f9a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 01051e3e635312255c8eb2d2ba81b72d3e1a6c5f035db0aacdb11e167d146b48
MD5 b6622e3af025b4e595936514c1864e9c
SHA1 27ffafa4f66cea8ee8bab892012eb269d16cbe88
SHA512 a1bd4803216d7d7d73594a9f465c5bfb005fc17a1d3dc12dc14f1cad47c4962491d856810ef969cc459fad366c39dfea03dae8ab899a8033c57c86eda4ec5c39
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c40e7fe84e9c132a0748bc7d70096b72d5e460e5b60612d4d7e368dcb822528e
MD5 62f4fd6c17908f145b0d81ff4747b039
SHA1 cc642022e9da0207b4c82953687c136a52334b28
SHA512 0c861d35c0ef60631dfef7c8671727293797ec361571cc22887faa2ac8773d8213dbc135b31bd32bb1811c0c8a5a35e8c50cd6258b08785b4e360ca6c4e6a47a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fc3ee1468ca6680bacc3a7fd5594c5e82e96834c26298606bbe4953b37cc295b
MD5 52563273d92d7b3417ecdc28dd920f29
SHA1 c67b2b82f1414246ca0c28c3c3a6f05b467aa4fc
SHA512 ce0c27fbe50ddf603e4cedd958d653fe92f4a7cc5a9211c2197878c37183c78298a31b5629ee8de8e84162283a14b4efbaf8d4a5b2ab894e70a6c5948d3d03c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8b9fbae154aee879070e1539dc75f433ac765efebf592d32889a4f170df98f16
MD5 a3955cc3ed73906723ee9575444c3991
SHA1 7f466f2b45f7deb19bd21a1f662d8dca54588630
SHA512 09b179ab17643a892bdca6573fe283c9aea81d34c4d9fc58fe5737e91bc564cea10c49c08e6dd8ebbdd5a1b671a59ec8f3cde4dc1007061b70ad367321ebdb73
MD5 SHA1 SHA512

Submit Download

svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBBBACBCABCCBAAABCCCCCBCBBABCAACBCABBAABCACBBABCCBB.exe
Size 21.0MB
SHA256 59aa041c4768a78c90d2b5cc54e49790b6824ffbd894eeb3a3c34c64539e2815
MD5 300b4fa3ef8ffdff13ffa77df8222bd7
SHA1 bce879daf5ac2e613e3f9aa2d7e3b6bc1ac06ce1
SHA512 1936a1e6610f84b65b5672e683ff774594109f28bcb5ef6e840a47016066853203d06cd3729c3a654e2e3c52b6807abc6eedd5d7d89e79b637aca09d50392ba4
SSDEEP 49152:U+ES+ES+ES+ES+ES+ET+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+EJ:LOU/jIEeQfoR/IuOFVjUu5f
TLSH
T1C9273B09FD4344B1D92B51B04DCFE3BF8A60BB2582128DF7FB4ECB5B6523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4124-44-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/4124-90-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/4124-64-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/4264-30-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/4264-78-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/4264-45-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/4264-0-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/4264-16-0x0000000000040000-0x0000000000061000-memory.dmp

Download