cf74a6d0a1f9fcd71ce7647ed815462297e40f3861c3a37f8f678e5746fbdae1

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_828ec2c7d0c779cdd838ad41346c13ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Size 8.3MB
Sample260905-23ffjsbk2s
SHA256 cf74a6d0a1f9fcd71ce7647ed815462297e40f3861c3a37f8f678e5746fbdae1
MD5 828ec2c7d0c779cdd838ad41346c13ce
SHA1 2f15804dea80c3f678735d962137fd55c9373d53
SHA512 723578c0095f17d330d7fde50023143877908a90cb4f8e1ef743e56fd285c6015da3a06dbf3f38476ac99fd1c533ce9f7f117dc5f11289d0b35f5be591b5d7bd
SSDEEP 49152:U+EUe+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EUe+Ex+Ex+Ex+Ex+Ev+Ex3:3OU/jIEeQfoR/IuOFVjUu5m
TLSH
T153967D06F98740B1E93B41B00CDBD3BF8670BA2585228EBBFB4DC71F6A32B515825756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
116	svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe
3180	svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe
3772	svchost_BBABABBCAACBCBBABCCBBACBBBABABABABBABBCCCBAACAACBBCAABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCCACBBABACAABCAACCABABACBCBBCACCABCBABAABACCCCCABCCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe"	2026-09-03_828ec2c7d0c779cdd838ad41346c13ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BABACBAAACABCBBCCBABCCBBCBABACBACCAABABACAABABCBBCCBACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABABBCAACBCBBABCCBBACBBBABABABABBABBCCCBAACAACBBCAABC.exe"	svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2512	sc.exe
2236	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3728	cmd.exe
4336	cmd.exe
4764	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_828ec2c7d0c779cdd838ad41346c13ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABABBCAACBCBBABCCBBACBBBABABABABBABBCCCBAACAACBBCAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3028	2026-09-03_828ec2c7d0c779cdd838ad41346c13ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
3028	2026-09-03_828ec2c7d0c779cdd838ad41346c13ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
3028	2026-09-03_828ec2c7d0c779cdd838ad41346c13ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
3028	2026-09-03_828ec2c7d0c779cdd838ad41346c13ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
116	svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe
116	svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe
116	svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe
116	svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	2026-09-03_828ec2c7d0c779cdd838ad41346c13ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Token: SeDebugPrivilege	116	svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1412	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3728	3028	2026-09-03_828ec2c7d0c779cdd838ad41346c13ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	100
PID 3728 wrote to memory of 4008	3728	cmd.exe	102
PID 116 wrote to memory of 4876	116	svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe	103
PID 4876 wrote to memory of 4712	4876	notepad.exe	104
PID 3028 wrote to memory of 4336	3028	2026-09-03_828ec2c7d0c779cdd838ad41346c13ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	106
PID 4336 wrote to memory of 2512	4336	cmd.exe	108
PID 3028 wrote to memory of 4764	3028	2026-09-03_828ec2c7d0c779cdd838ad41346c13ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	109
PID 4764 wrote to memory of 2236	4764	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-03_828ec2c7d0c779cdd838ad41346c13ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_828ec2c7d0c779cdd838ad41346c13ce_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACACBAAACBBACCBCAABABBCCBBACAABCAABCBAABCBBACACCBAAAABACCABCBACAAAACCCCCBCBAACACCAABCABBBCAAAACBABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACACBAAACBBACCBCAABABBCCBBACAABCAABCBAABCBBACACCBAAAABACCABCBACAAAACCCCCBCBAACACCAABCABBBCAAAACBABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAACCCBACCCCBBBCBBBBBCCBCBAAABBBBCABCABBCBABBABABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe" start= auto displayName= "UserDataSvc_CCAACCCBACCCCBBBCBBBBBCCBCBAAABBBBCABCABBCBABBABABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAACCCBACCCCBBBCBBBBBCCBCBAAABBBBCABCABBCBABBABABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe" start= auto displayName= "UserDataSvc_CCAACCCBACCCCBBBCBBBBBCCBCBAAABBBBCABCABBCBABBABABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAACCCBACCCCBBBCBBBBBCCBCBAAABBBBCABCABBCBABBABABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAACCCBACCCCBBBCBBBBBCCBCBAAABBBBCABCABBCBABBABABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4712

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe
1⤵
- Executes dropped EXE
PID:3180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABBCAACBCBBABCCBBACBBBABABABABBABBCCCBAACAACBBCAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABBCAACBCBBABCCBBACBBBABABABABBABBCCCBAACAACBBCAABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e0df8a67f78277c61fd19038a43c5e0d59fc5628965dd0283ca957dda9aabf9a
MD5 7bd266322bcd38e3be2110401064531d
SHA1 45854b0fafc6951adc5ba93ac2eabf2732364754
SHA512 c177f8be94fa894362d7d831769662cd9c23b505a5ea95a40db6cadb588e075011c68c7aa5eb975328fc48bb5ab163729c5add12f575df250cf57ab7f59596c6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 68e57a39dc4c5edf98d8958d811499e17708832f890aa6dff17fb56ac06038fd
MD5 3391949af9517f1fafeba0458fa5c98c
SHA1 3c67b669b72e770b7f6de1f7cbf25fc32028d18a
SHA512 c12ef407f47aa42532ef5836500715e4dce593549903470ed3f4a21a82ea2f1c547685ffab5e43b44a5385c2e914eb21c2abf86b3e543b5c981c1d64300986a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 597580e05cac0773acc1c3529d5123f52750c28f7e7a5bdfc9808eb4a3318ae8
MD5 86d8634adbc36410bd39f95f783702f7
SHA1 8cd45e440cacff7c2425630e7552b74cc6e760be
SHA512 ba2885f79193a38e2ca133bf78ebdd0aff492869253f9dce56795824039929981a6630c051268b3963fee2c742edabb2f2c6bc27a01fd15319d2217d13bcaf4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 de63dba23d7e39b72befea9460648dcc4bb2f9a2e780e1b146318494c92bad53
MD5 ef31ae8c464adeaefc46b76a13bd7a94
SHA1 95fefc7695080d4ed012e851c266ebb506f9ac31
SHA512 80e392d11f7392e36a9073297b1fcc3e1eba552e4e0e4e896fd819eb458b9bdf1aeaed900dfb0193efb3d1b15a1149b4495eaaeefc70c05a21d45754b7374734
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d2a7a841236b6ad7d931cf5012fbc3317fae5578de4b331e79acf6efc0acc7bd
MD5 e6ae4ad8044715f810c6e2967e64f19b
SHA1 318921e6175ff0a4076daa3b6b25a2cacf80b096
SHA512 b1d6a368f587248fbec622c7d69cf7f5a537dab3a36470c555a8ad7ae8dbcce2adf2953dfade8af769efa314cc01e26f81b5da2fba3fa3fc70208fe61ed26b99
MD5 SHA1 SHA512

Submit Download

svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABBBAAACCACBABCBBAABAAAAAABCAAABABBBBCCACCCABBBBCBAB.exe
Size 8.3MB
SHA256 cf74a6d0a1f9fcd71ce7647ed815462297e40f3861c3a37f8f678e5746fbdae1
MD5 828ec2c7d0c779cdd838ad41346c13ce
SHA1 2f15804dea80c3f678735d962137fd55c9373d53
SHA512 723578c0095f17d330d7fde50023143877908a90cb4f8e1ef743e56fd285c6015da3a06dbf3f38476ac99fd1c533ce9f7f117dc5f11289d0b35f5be591b5d7bd
SSDEEP 49152:U+EUe+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EUe+Ex+Ex+Ex+Ex+Ev+Ex3:3OU/jIEeQfoR/IuOFVjUu5m
TLSH
T153967D06F98740B1E93B41B00CDBD3BF8670BA2585228EBBFB4DC71F6A32B515825756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-26-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/116-36-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/3028-7-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/3028-0-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/3180-79-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/3772-80-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/4876-60-0x00000000022E0000-0x00000000022E1000-memory.dmp

Download