c8222e77e8d5be86dbb2244ef45e8bbf72bfd94a66bd5e84dfb5a554a17eafa1

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Size 15.2MB
Sample260905-2rttsstglg
SHA256 c8222e77e8d5be86dbb2244ef45e8bbf72bfd94a66bd5e84dfb5a554a17eafa1
MD5 8fa2c59f666e774b5d39af84f1112fbf
SHA1 a83653c5b29e90d9eb827a5397f149b4920f1513
SHA512 24c80df781a5f7626467430dcb762619ce39fcb17078e4f500a506d85e1cf36ef14565b2a069e9f32dd6be2333da721b6fe8a66d5a2a5df72211daf71f090c0b
SSDEEP 49152:U+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+E1:f+4jn
TLSH
T133F62909F94344B1D92B51B04CCFE3BF8A60BB2586128EF7FB4ECB5B7523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3172	svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe
2728	svchost_ACCCACBCCACCACCABAAABBACBCACBCACBABBCCAABABBAACBABCBACA.exe
2180	svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBAACBBCCACBCABAABBAAAAAABAACCACBCAAABCCCABBBBAAAACAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCACBCCACCACCABAAABBACBCACBCACBABBCCAABABBAACBABCBACA.exe"	svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABACBCBACBCCBCBCCABBBBBCABBBCCCBBCBCABCCAACBCACAAAABCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe"	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2648	sc.exe
2820	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
820	cmd.exe
768	cmd.exe
2604	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCACBCCACCACCABAAABBACBCACBCACBABBCCAABABBAACBABCBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2416	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
2416	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
2416	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
2416	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
3172	svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe
3172	svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe
3172	svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe
3172	svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe
2728	svchost_ACCCACBCCACCACCABAAABBACBCACBCACBABBCCAABABBAACBABCBACA.exe
2728	svchost_ACCCACBCCACCACCABAAABBACBCACBCACBABBCCAABABBAACBABCBACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Token: SeDebugPrivilege	3172	svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe
Token: SeDebugPrivilege	2728	svchost_ACCCACBCCACCACCABAAABBACBCACBCACBABBCCAABABBAACBABCBACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 820	2416	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	91
PID 820 wrote to memory of 4996	820	cmd.exe	93
PID 3172 wrote to memory of 1364	3172	svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe	94
PID 2416 wrote to memory of 768	2416	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	97
PID 768 wrote to memory of 2820	768	cmd.exe	99
PID 2416 wrote to memory of 2604	2416	2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	100
PID 2604 wrote to memory of 2648	2604	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_8fa2c59f666e774b5d39af84f1112fbf_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBCBABABABBBCBABCBBBACCCBCACBCAACCBAABCBBABAACCBCBABBCCACBAAABCBCBCCAACAACCCCCACCAACBAABACABBBACCAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBCBABABABBBCBABCBBBACCCBCACBCAACCBAABCBBABAACCBCBABBCCACBAAABCBCBCCAACAACCCCCACCAACBAABACABBBACCAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCBCCABACBBCABCBBAACAABABCBCCACBBBABABCBACBCBCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe" start= auto displayName= "UserDataSvc_ABBCBCCABACBBCABCBBAACAABABCBCCACBBBABABCBACBCBCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBCBCCABACBBCABCBBAACAABABCBCCACBBBABABCBACBCBCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe" start= auto displayName= "UserDataSvc_ABBCBCCABACBBCABCBBAACAABABCBCCACBBBABABCBACBCBCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCBCCABACBBCABCBBAACAABABCBCCACBBBABABCBACBCBCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBCBCCABACBBCABCBBAACAABABCBCCACBBBABABCBACBCBCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2648

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1364

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBCCACCACCABAAABBACBCACBCACBABBCCAABABBAACBABCBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBCCACCACCABAAABBACBCACBCACBABBCCAABABBAACBABCBACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe
1⤵
- Executes dropped EXE
PID:2180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 182bada98087e37bbace748e773811a738f3ffcc69bf7302eb992dd63f4f82a0
MD5 2d8f4cb11c74d8b31ef9a7ce53f6f5cf
SHA1 6a308e815ec8264fecc5333bc40171053ca8e546
SHA512 e974babfa00cfe295597285033de9fab5a7d2f6ed336281540fe1adda6a59ae90097d02fd9e603f099cc367b7269e395331ab13fa1aa8c18609fd93fd586ce4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f26fe1a213dc74e6001f3c1618b5e456b7e3ed745ef3e81cec771c79d785c100
MD5 aecda6c1481ea248771da6cf4312e342
SHA1 f661abbcf80ba77b3b9c9817cd877e799dcc2a28
SHA512 83bf7955999c5dc8e3d73d1920e5da0659ed89a9ad66154e51cbdfa895eccdf6a020c8e66dc53a37f613424bddb131cbc9b79950d2c5afb8670bad858a127ba4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9a21c1950e75e2aa7c3bad36dedbb09c983780568d0641e4c5ee1049c7199ebc
MD5 6b8684affdcdc527d29bf560818a0cf5
SHA1 19d97a8cb038639cdc6f79f9acd42a76fcc9df8d
SHA512 462261b39b28b392aa9cf9ac12723fb6f20b1d03d5b15fe2197e5f98738f41872925f5c24b06c98816342846ade2cfda256714d9339047248b6483c322900520
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ff8e7bd0c636048832f21a3c8d67cce27e3475c0a3eef449e9be40401f0198e0
MD5 86f43430e0e82834667d1b35672dc6a0
SHA1 f148e19e1346e745ad19ee5ce110ac1763ae27e3
SHA512 7865cb1c4ceac12fe63822a34df7bec6aa0b1b6f3c9ed494cf9f060a0fe9b0edc960e9d9fb94a1b246076cb628578bb46e221673f87abdcfc0b27c76d5d00c78
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 278286c09a4710605a32e95c50af67dbe820bb9247be706e1ad253419e49bc1b
MD5 be33881d952c246a62e7b0b98cc16052
SHA1 b0607c000f5c2b9f71706ee626b07bea16dc634d
SHA512 af83f2b66c49578556a28ac3478e93e1ddc63d277801e8d14986e6ab198535e3c7156a7a6068d419324eb5cdd05af050fd4056f18196baba0809a87a5a208a99
MD5 SHA1 SHA512

Submit Download

svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAABCCAAABCCCBBCABCBCBCAABBCCBAAABBBBAACBCBCABCCCBBBA.exe
Size 15.2MB
SHA256 c8222e77e8d5be86dbb2244ef45e8bbf72bfd94a66bd5e84dfb5a554a17eafa1
MD5 8fa2c59f666e774b5d39af84f1112fbf
SHA1 a83653c5b29e90d9eb827a5397f149b4920f1513
SHA512 24c80df781a5f7626467430dcb762619ce39fcb17078e4f500a506d85e1cf36ef14565b2a069e9f32dd6be2333da721b6fe8a66d5a2a5df72211daf71f090c0b
SSDEEP 49152:U+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+E1:f+4jn
TLSH
T133F62909F94344B1D92B51B04CCFE3BF8A60BB2586128EF7FB4ECB5B7523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e818cc2bfb0a00939d7c2cb7badc818ccbf9952d0ade07ef319219608ace5e30
MD5 611f40e068a68b8b8ce1df60a4e000f5
SHA1 72afdbd2f3cdcbd178ee4644507ecdec36430ce6
SHA512 2db1d8e623fe002ca49f3cca3eb6f02d2d6c90c0c3ffac78672c99cde1c8fdf93563d08b5bc90fa9c191d29dfa00b6b114b77b437ed38e275d8e37fff0b241a5
TLSH
T1B511C464E0F5DC67F4212417A5299B970CA47FDFD85CAB98130D821CFA85C7CAD398E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2416-0-0x0000000000720000-0x0000000000741000-memory.dmp

Download

memory/2416-8-0x0000000000720000-0x0000000000741000-memory.dmp

Download

memory/3172-24-0x0000000000D40000-0x0000000000D61000-memory.dmp

Download

memory/3172-34-0x0000000000D40000-0x0000000000D61000-memory.dmp

Download