1b5f3913d510b5537ebe5a2970d4b77f525a171ff8f2d98f41ba35b5f347d5c8

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Size 16.7MB
Sample260905-d28tpsej4w
SHA256 1b5f3913d510b5537ebe5a2970d4b77f525a171ff8f2d98f41ba35b5f347d5c8
MD5 90e8ebcb596a6e369747a17c26c24a46
SHA1 2f284d624823e2056e881ed2901d624432731c0d
SHA512 54385ea10717be94ce176b2053f7c9e4bdbd559d0f492a132d14cfeb62744d17093f6c8b3b8384ce1309404489533ca4d407c7f56366ff76244992bf3974b526
SSDEEP 49152:U+ES+ES+Ena+ES+EnG+EnK+ES+ES+EnG+EnK+ES+ES+EnX+ES+EnG+EnK+ES+ESL:z+4jn
TLSH
T19F074B09F94340B1D92B10B04DCBD2BF8A60BF2587128EE7F78DDB5B7932BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1140	svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe
5184	svchost_CBCABAAACCBAACCCACACBBCBBCCBCAABACBCCCACCBCCBBCBCCBCABB.exe
5612	svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBBCABCCCBCCBCCBCABBBBABBCCAAACBBCBACAACABAAAACCACBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe"	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBCBCCBCCBBBAABBAABACCAABBBCACBCCCBBBCACBCBABCABBCBAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCABAAACCBAACCCACACBBCBBCCBCAABACBCCCACCBCCBBCBCCBCABB.exe"	svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5584	sc.exe
4856	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5900	cmd.exe
5504	cmd.exe
1824	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCABAAACCBAACCCACACBBCBBCCBCAABACBCCCACCBCCBBCBCCBCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4824	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
4824	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
4824	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
4824	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
1140	svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe
1140	svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe
1140	svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe
1140	svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe
5184	svchost_CBCABAAACCBAACCCACACBBCBBCCBCAABACBCCCACCBCCBBCBCCBCABB.exe
5184	svchost_CBCABAAACCBAACCCACACBBCBBCCBCAABACBCCCACCBCCBBCBCCBCABB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Token: SeDebugPrivilege	1140	svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe
Token: SeDebugPrivilege	5184	svchost_CBCABAAACCBAACCCACACBBCBBCCBCAABACBCCCACCBCCBBCBCCBCABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 5900	4824	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	92
PID 5900 wrote to memory of 2592	5900	cmd.exe	94
PID 1140 wrote to memory of 3968	1140	svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe	95
PID 4824 wrote to memory of 5504	4824	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	98
PID 5504 wrote to memory of 4856	5504	cmd.exe	100
PID 4824 wrote to memory of 1824	4824	2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	101
PID 1824 wrote to memory of 5584	1824	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_90e8ebcb596a6e369747a17c26c24a46_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACAACAACCAACCBCBAABCBBCBABBABBCACCAAACBBAAAAAABACCACCABACABBBAACABAACCAAAAABACCABBBAACBCAABACCBBABCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACAACAACCAACCBCBAABCBBCBABBABBCACCAAACBBAAAAAABACCACCABACABBBAACABAACCAAAAABACCABBBAACBCAABACCBBABCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCABBBABBBBBBCBABCBBBBBCACABCACBBAAACBCAAACBBABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe" start= auto displayName= "UserDataSvc_ACBCABBBABBBBBBCBABCBBBBBCACABCACBBAAACBCAAACBBABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5504
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCABBBABBBBBBCBABCBBBBBCACABCACBBAAACBCAAACBBABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe" start= auto displayName= "UserDataSvc_ACBCABBBABBBBBBCBABCBBBBBCACABCACBBAAACBCAAACBBABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCABBBABBBBBBCBABCBBBBBCACABCACBBAAACBCAAACBBABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCABBBABBBBBBCBABCBBBBBCACABCACBBAAACBCAAACBBABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5584

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3968

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABAAACCBAACCCACACBBCBBCCBCAABACBCCCACCBCCBBCBCCBCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABAAACCBAACCCACACBBCBBCCBCAABACBCCCACCBCCBBCBCCBCABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5184

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe
1⤵
- Executes dropped EXE
PID:5612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 04f4e03bae6df3b24198e66d1d50947126319bc813c8263845f9a7eeb690d8e6
MD5 052ad91f79a6914a381be695aad80d3e
SHA1 f75bfb5218a3e3b32b75319beb8a7bbd21614339
SHA512 6e27c8137eb6621c041fdb579ab6ae694e9a87e846c5565fc5de99baee3ee8aeba3d6502a162f4ba840f4470fadaa0d0fbc3ecfe38a5d6f570662467a6778161
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b8c25441f94ee424953dddfe36d4e227d6d7443149122745b3938aeda59f7400
MD5 8d6241d8cdf51e9345ea5bf521905b89
SHA1 7fe7030946d9c5afaf8ab52a7ad6f6aa7dca760b
SHA512 ddedb1dda9fc02e1b80c8ab248aef25801dc02944eba86313ac062a1b3e18a01f995a61d285143e0a8f63d2093b1f70caf2145e3f30c91518f91922d4bbbd8de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c794ca95c89613957462cd924a2065b6d04e3560da273849f9b29fbd36f72bf9
MD5 405a54431ebd245bd0421c94f6d0a0dd
SHA1 2a3a6d1ed0eb55f95ceb3b4c9f47d5ef273f6508
SHA512 d3291586091b67194486343c800370050382364919d92862237ad34e5b48f7624e28a9d6cd013e9e43f0f68318b075a6a1276fbc2da756589d5918adf8b7cb14
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 927523996b00a872a8b0fe610be81d8b503123a77e0d0b17d0142747f1d7e632
MD5 7a131bb801e9ce613bc905ac7b6ed615
SHA1 97909b5883c26aa827285bdf0d3dd76ba9c5a078
SHA512 919dacadeaac90e0b0c2fc0274891fdf086ea5f407089a41d5e47ed4a669a4259140dfd23a1f9ca47bc70b9cf528ad0a3a6eb0a823a525d6852fc0f8f2554920
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 755f23f69451cabc75b0a66f40e774b893d8cd8e3233b5c3c76cf1f61f82e06f
MD5 f09dd3716ea254dd5ce66dafbc31c023
SHA1 3e639437c897e01b104bd30a08c094a62bd10468
SHA512 b6fc9c45d03ebf41209143243187af28efca494a00184c68b86c89634c35641779ade848b44f176f9496d0b4b16c70e5d20445dc769bc5383545a56b94f9aff4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c243b0e847d6d84e3898a3040a9e25416d2e9525729db6f2d7b9e02ecf448fba
MD5 152139bcc96d34e140affb077e95c26f
SHA1 a08a3715d19263852549c41fb6f92c1189bdffd7
SHA512 2bf247af2be6c01f4d16d284345a8fc35837163a06ea13941c33abd9f33d80a9f7e8ef2221fc2d218d21e68b415b049bfa5d81e9a18ea01f85a1f748ab51c74a
MD5 SHA1 SHA512

Submit Download

svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCBBCCBBCAACAAACAAACBCCBABACABABABBBABAABAABBABAAAA.exe
Size 16.7MB
SHA256 1b5f3913d510b5537ebe5a2970d4b77f525a171ff8f2d98f41ba35b5f347d5c8
MD5 90e8ebcb596a6e369747a17c26c24a46
SHA1 2f284d624823e2056e881ed2901d624432731c0d
SHA512 54385ea10717be94ce176b2053f7c9e4bdbd559d0f492a132d14cfeb62744d17093f6c8b3b8384ce1309404489533ca4d407c7f56366ff76244992bf3974b526
SSDEEP 49152:U+ES+ES+Ena+ES+EnG+EnK+ES+ES+EnG+EnK+ES+ES+EnX+ES+EnG+EnK+ES+ESL:z+4jn
TLSH
T19F074B09F94340B1D92B10B04DCBD2BF8A60BF2587128EE7F78DDB5B7932BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 36958504d0424632c2b7ee5ce55417b732b15bae4a4cd89ea61384ebcb8cada5
MD5 a3ed3fdf0502c0ce1830e07f5e3890a4
SHA1 f66eaa2674446b24eaca65ab01d37d2aa6d45dfd
SHA512 ed44a3c2656e7d5ee0dc4bf3e1b96cf70674859763a4d65b4fd84e1967535f65abccc973e1f3df5baf6a04f9a61eac344b327104e5077e59b490d13d243a94a1
TLSH
T12A119191F0A5DC33F43268CFA3166B874C943B8F9C58EB2413998219A755937AD168E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1140-34-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/1140-24-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/4824-7-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/4824-0-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/5184-79-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/5612-80-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download