1b5f3913d510b5537ebe5a2970d4b77f525a171ff8f2d98f41ba35b5f347d5c8

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Size 16.7MB
Sample260905-d28tpsej4w
SHA256 1b5f3913d510b5537ebe5a2970d4b77f525a171ff8f2d98f41ba35b5f347d5c8
MD5 90e8ebcb596a6e369747a17c26c24a46
SHA1 2f284d624823e2056e881ed2901d624432731c0d
SHA512 54385ea10717be94ce176b2053f7c9e4bdbd559d0f492a132d14cfeb62744d17093f6c8b3b8384ce1309404489533ca4d407c7f56366ff76244992bf3974b526
SSDEEP 49152:U+ES+ES+Ena+ES+EnG+EnK+ES+ES+EnG+EnK+ES+ES+EnX+ES+EnG+EnK+ES+ESL:z+4jn
TLSH
T19F074B09F94340B1D92B10B04DCBD2BF8A60BF2587128EE7F78DDB5B7932BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4932	svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe
3772	svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe
4800	svchost_CCABACCBAAAAAABBACCABABBBCBCCCAAABACBACBACAACCCACBCAAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCBACCCAACBACCBACBCCACCACBCBBCCAACBBCCAABCBBAABACBCACCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABACCBAAAAAABBACCABABBBCBCCCAAABACBACBACAACCCACBCAAAC.exe"	svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCCABBAAAABCBBBCCCACCBCCCBABACBBBBAACCACBCABBBBABBACACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe"	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5032	sc.exe
1676	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3312	cmd.exe
3548	cmd.exe
3236	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABACCBAAAAAABBACCABABBBCBCCCAAABACBACBACAACCCACBCAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3512	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
3512	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
3512	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
3512	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
4932	svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe
4932	svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe
4932	svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe
4932	svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3512	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Token: SeDebugPrivilege	4932	svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2492	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 3312	3512	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	100
PID 3312 wrote to memory of 1872	3312	cmd.exe	102
PID 4932 wrote to memory of 4972	4932	svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe	103
PID 4972 wrote to memory of 1612	4972	notepad.exe	104
PID 3512 wrote to memory of 3548	3512	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	106
PID 3548 wrote to memory of 5032	3548	cmd.exe	108
PID 3512 wrote to memory of 3236	3512	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	109
PID 3236 wrote to memory of 1676	3236	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBCBBCBCCCCBCBBCCAAAABBCBCABABACCBACCBCBCCCBCBBCACCCBABBBCCBBCAABAACBBACCAAACCAAABCBCCCACCBBABCCABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBCBBCBCCCCBCBBCCAAAABBCBCABABACCBACCBCBCCCBCBBCACCCBABBBCCBBCAABAACBBACCAAACCAAABCBCCCACCBBABCCABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACCAABABCACAAAABAAABAABBACBCABCBABABCBACAABACBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe" start= auto displayName= "UserDataSvc_CCACCAABABCACAAAABAAABAABBACBCABCBABABCBACAABACBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACCAABABCACAAAABAAABAABBACBCABCBABABCBACAABACBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe" start= auto displayName= "UserDataSvc_CCACCAABABCACAAAABAAABAABBACBCABCBABABCBACAABACBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACCAABABCACAAAABAAABAABBACBCABCBABABCBACAABACBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACCAABABCACAAAABAAABAABBACBCABCBABABCBACAABACBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1676

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1612

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2492

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe
1⤵
- Executes dropped EXE
PID:3772

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACCBAAAAAABBACCABABBBCBCCCAAABACBACBACAACCCACBCAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACCBAAAAAABBACCABABBBCBCCCAAABACBACBACAACCCACBCAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 04f4e03bae6df3b24198e66d1d50947126319bc813c8263845f9a7eeb690d8e6
MD5 052ad91f79a6914a381be695aad80d3e
SHA1 f75bfb5218a3e3b32b75319beb8a7bbd21614339
SHA512 6e27c8137eb6621c041fdb579ab6ae694e9a87e846c5565fc5de99baee3ee8aeba3d6502a162f4ba840f4470fadaa0d0fbc3ecfe38a5d6f570662467a6778161
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c794ca95c89613957462cd924a2065b6d04e3560da273849f9b29fbd36f72bf9
MD5 405a54431ebd245bd0421c94f6d0a0dd
SHA1 2a3a6d1ed0eb55f95ceb3b4c9f47d5ef273f6508
SHA512 d3291586091b67194486343c800370050382364919d92862237ad34e5b48f7624e28a9d6cd013e9e43f0f68318b075a6a1276fbc2da756589d5918adf8b7cb14
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c243b0e847d6d84e3898a3040a9e25416d2e9525729db6f2d7b9e02ecf448fba
MD5 152139bcc96d34e140affb077e95c26f
SHA1 a08a3715d19263852549c41fb6f92c1189bdffd7
SHA512 2bf247af2be6c01f4d16d284345a8fc35837163a06ea13941c33abd9f33d80a9f7e8ef2221fc2d218d21e68b415b049bfa5d81e9a18ea01f85a1f748ab51c74a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 80b84c93ffea86e2d4b3bc5ed297e26e93baaed9b837e29db5e2551aadaa755d
MD5 e0c2e51cb92e2179a39edf6d5cc6b17e
SHA1 9f136c7e692e6eaaea0e7dec4488d5cb562d9f24
SHA512 34d35dbb900371a22a48ff2af25de9fcda87280e0159bc3daa5cdfebcebfb20f92f600ddc7caf9332b32825eb00cd3838ca91a89b6e63fe54acc77be471ea840
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0ac3d1800e09b9d748450629236b6ce4a26ce56a7fb6a0fd06b885599f46790c
MD5 8000b38e803beecf9ca78ce385d6e924
SHA1 beb279ca99bf1def23bf5a74318a09b3a49cf71a
SHA512 55e407864eab2318e6bb44294fe6c2997f5f36398628ec86dc15689737befc3f93e30603c44800fa08ccb17547e69dc6fc59debafa21cdb3cd41497aed150231
MD5 SHA1 SHA512

Submit Download

svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBCACBCABBCCCBBBCCBABAACACBCACCCCAACBABCCBACBBBAABB.exe
Size 16.7MB
SHA256 1b5f3913d510b5537ebe5a2970d4b77f525a171ff8f2d98f41ba35b5f347d5c8
MD5 90e8ebcb596a6e369747a17c26c24a46
SHA1 2f284d624823e2056e881ed2901d624432731c0d
SHA512 54385ea10717be94ce176b2053f7c9e4bdbd559d0f492a132d14cfeb62744d17093f6c8b3b8384ce1309404489533ca4d407c7f56366ff76244992bf3974b526
SSDEEP 49152:U+ES+ES+Ena+ES+EnG+EnK+ES+ES+EnG+EnK+ES+ES+EnX+ES+EnG+EnK+ES+ESL:z+4jn
TLSH
T19F074B09F94340B1D92B10B04DCBD2BF8A60BF2587128EE7F78DDB5B7932BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3512-0-0x0000000000720000-0x0000000000741000-memory.dmp

Download

memory/3512-7-0x0000000000720000-0x0000000000741000-memory.dmp

Download

memory/4932-27-0x0000000000BC0000-0x0000000000BE1000-memory.dmp

Download

memory/4932-37-0x0000000000BC0000-0x0000000000BE1000-memory.dmp

Download

memory/4972-60-0x0000000005140000-0x0000000005141000-memory.dmp

Download