c8222e77e8d5be86dbb2244ef45e8bbf72bfd94a66bd5e84dfb5a554a17eafa1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Size 15.2MB
Sample260905-2rttsstglg
SHA256 c8222e77e8d5be86dbb2244ef45e8bbf72bfd94a66bd5e84dfb5a554a17eafa1
MD5 8fa2c59f666e774b5d39af84f1112fbf
SHA1 a83653c5b29e90d9eb827a5397f149b4920f1513
SHA512 24c80df781a5f7626467430dcb762619ce39fcb17078e4f500a506d85e1cf36ef14565b2a069e9f32dd6be2333da721b6fe8a66d5a2a5df72211daf71f090c0b
SSDEEP 49152:U+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+E1:f+4jn
TLSH
T133F62909F94344B1D92B51B04CCFE3BF8A60BB2586128EF7FB4ECB5B7523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
440	svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe
3640	svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe
4492	svchost_BABBCCBBABBCBBBAABBCBAABACABBBAAACBACBCBCBCBABBAABACCCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ACCBAACCBACBCCAABBACCCAABACBBBBCBABCBAAACBACCCAACBCBABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe"	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBCBBBACBACCBBCCAACAAABCCAACCBCBACABABCCCBCCAACCCAACABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBCCBBABBCBBBAABBCBAABACABBBAAACBACBCBCBCBABBAABACCCA.exe"	svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4672	sc.exe
4608	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3172	cmd.exe
668	cmd.exe
4240	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4448	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
4448	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
4448	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
4448	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
440	svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe
440	svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe
440	svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe
440	svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Token: SeDebugPrivilege	440	svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3988	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 3172	4448	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	104
PID 3172 wrote to memory of 4720	3172	cmd.exe	106
PID 4448 wrote to memory of 668	4448	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	114
PID 668 wrote to memory of 4608	668	cmd.exe	116
PID 4448 wrote to memory of 4240	4448	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	117
PID 4240 wrote to memory of 4672	4240	cmd.exe	119
PID 440 wrote to memory of 1268	440	svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe	121
PID 1268 wrote to memory of 3336	1268	notepad.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCAABAABABAAACCACBACABCACAABACCABACCAACABBABBCBBCABBBCCCBCBCABABCCAABABCCCABCBCCCBABCBAACBCABCBCBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCAABAABABAAACCACBACABCACAABACCABACCAACABBABBCBBCABBBCCCBCBCABABCCAABABCCCABCBCCCBABCBAACBCABCBCBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCCBBAACCBACCBAACBABAAAACAABBABBBAACBBCBCBABAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe" start= auto displayName= "UserDataSvc_CBCCCBBAACCBACCBAACBABAAAACAABBABBBAACBBCBCBABAAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCCBBAACCBACCBAACBABAAAACAABBABBBAACBBCBCBABAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe" start= auto displayName= "UserDataSvc_CBCCCBBAACCBACCBAACBABAAAACAABBABBBAACBBCBCBABAAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCCBBAACCBACCBAACBABAAAACAABBABBBAACBBCBCBABAAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCCBBAACCBACCBAACBABAAAACAABBABBBAACBBCBCBABAAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4672

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:440
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3336

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe
1⤵
- Executes dropped EXE
PID:3640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3988

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCBBABBCBBBAABBCBAABACABBBAAACBACBCBCBCBABBAABACCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCBBABBCBBBAABBCBAABACABBBAAACBACBCBCBCBABBAABACCCA.exe
1⤵
- Executes dropped EXE
PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 34bf8a7250340e177ff18024fbc1bfee0ded7ff44e997fb42fef97a5aa16f096
MD5 51cba28f9596fb65dfd02c3da936575e
SHA1 ca14638b11ab681f85598cb1562bef7732af24c4
SHA512 e8d6d372a8db9844223e8ee567a96ea50a4044c216f7a6f0dda649d089177059242ea51afae859d9d51137db65df5642e4e72c0f792261e83f7a423596e28ce2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 593ae43367656061398f38ecb6d372df0d4a85a227e31f1a658d739f51472e2d
MD5 8154a388d510208d0075945dbca0d5f2
SHA1 38ea794080071d7768acab90197b4376a261edf0
SHA512 146e951b8306aa480e0e1d34915de126be556b44a4d14cf17cda183b891ac64303e3a7e541ad4ea759882287872aa5c75a7b2d0ebcdb70685cf5b651105affc4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7863b28c56eb99aad12121323ca086f6bfe5dc3d442865bc7474b3d3b1f751ef
MD5 d88e28d61ab8c5013e0f6cda0a2b622e
SHA1 fd25a11986e3050b6c31eeafa860281f714e650d
SHA512 67c61472387f852f66fe014bcac5b7d24bd939191a42596c7f9a2f2e4af81c5ed6fc7635e48c672b925d9f2fe4b9989e95c3086cd31a45f1db0df12b0cff7481
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 14bbf3aa94c71a27b356b9ca1bea72ee22301f70d4f017149670861ae284363b
MD5 826e0a6553c339e6ef874676fed31a58
SHA1 d908005a572d0c876918afec021df605c8d96a7c
SHA512 0d4f42ac9e7bc64d9cc49fea8f7bc272b36c7cbef99b48228e141341d69537c22ebe73116f40436d0dd447b2f44f5c019179088dc33c659a5d6a1dca95ecdd4d
MD5 SHA1 SHA512

Submit Download

svchost_BABBCCBBABBCBBBAABBCBAABACABBBAAACBACBCBCBCBABBAABACCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCBBABBCBBBAABBCBAABACABBBAAACBACBCBCBCBABBAABACCCA.exe
Size 1.9MB
SHA256 eeac6c4bcbbd5fb01f56c847bc6e531ea8448610c46edbd03be8dc61c8535ee9
MD5 66046a5d8374ba4dfcd312909e856bc9
SHA1 3754b5d555f20ed848c5af5cb034eac849d7fcbb
SHA512 7cc893f5bc35f9a2c648fbb96136e4973db9e94693ea974d6694d04fef2903b1c673510fbf684da5cb9f4148dc0f59a5725445c5e47ba517577b33f05b93c6aa
SSDEEP 49152:U+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+EJ:n
TLSH
T14E952A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BABBCCBBABBCBBBAABBCBAABACABBBAAACBACBCBCBCBABBAABACCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCBBABBCBBBAABBCBAABACABBBAAACBACBCBCBCBABBAABACCCA.exe
Size 1.3MB
SHA256 a5a8573ef52ca381c8bbb4304eeb1cae0764a21628428cb4326853d8350a35a0
MD5 ff98ff0d32d97539ed574ad553a3a609
SHA1 8ddc4fe1a9e7b16dc765337e6f4b70796e5b3f41
SHA512 cfd9043fc73c9de4daf6453ec9971b821afc8311bdd51ef3125826a2a8e869e842aab3ded0ab76af1e51f2abcd021714dcc522090d985dd3009123e558459a98
SSDEEP 24576:m9+EM0q9+EM0q9+EM0q9+EM0qq9+EM0q9+EM0q9+EM0q9+EM0q9+EM0q9+EM0q9Q:U+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ESQ
TLSH
T175552A09FD4340B1D92B51B04DCFE3BF8A60BB2586128DF7FB4ECB5BA523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACCCAAACABCCAABABBBACAACABACCAAAAACABABABCBACABCAAA.exe
Size 15.2MB
SHA256 c8222e77e8d5be86dbb2244ef45e8bbf72bfd94a66bd5e84dfb5a554a17eafa1
MD5 8fa2c59f666e774b5d39af84f1112fbf
SHA1 a83653c5b29e90d9eb827a5397f149b4920f1513
SHA512 24c80df781a5f7626467430dcb762619ce39fcb17078e4f500a506d85e1cf36ef14565b2a069e9f32dd6be2333da721b6fe8a66d5a2a5df72211daf71f090c0b
SSDEEP 49152:U+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+E1:f+4jn
TLSH
T133F62909F94344B1D92B51B04CCFE3BF8A60BB2586128EF7FB4ECB5B7523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-27-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/440-40-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/1268-68-0x0000000005350000-0x0000000005351000-memory.dmp

Download

memory/4448-0-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/4448-8-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download