d57ffab5f955d76b1d147edb1c6a20680cbf5a2e95b89a0a8665a2e5e661eeca

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_b1e494fa52e748316998a920f24f8500_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Size 17.0MB
Sample260906-ys52nsda97
SHA256 d57ffab5f955d76b1d147edb1c6a20680cbf5a2e95b89a0a8665a2e5e661eeca
MD5 b1e494fa52e748316998a920f24f8500
SHA1 582274146960a47bfde6e0d1e7804fd4432bdc38
SHA512 42430d2a07772a5c3dcbacb65f9e1e0ec9a9fd644d1ff7aeb0e7db878d30cecb5d70a2d0e330d5f8cf1533374b5b6deb84dbf8f5b515cb56b468cbf89ae6c409
SSDEEP 49152:U+EnG+EnK+ES+ES+Ena+ES+EnG+EnK+ES+ES+EnG+EnK+ES+ES+EnX+ES+EnG+E2:9+4jn
TLSH
T1F1074A09F94340B1D92B10B04DCBD2BF8A60BF2587128EE7F78DDB5B7932BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6124	svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe
1288	svchost_CCCBBCCCCCBCCCBBBCABAACCBAACBBBACAABCCACACCBBACBABABBCA.exe
8	svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCACCBAAAACACCAABCACACBBACAAACACCBCAABCCBCCABACABCCCBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe"	2026-09-06_b1e494fa52e748316998a920f24f8500_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCBACCACABAAACCAABCBBABACBCCCCACBCBACACBABACBAACBCACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBBCCCCCBCCCBBBCABAACCBAACBBBACAABCCACACCBBACBABABBCA.exe"	svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5968	sc.exe
3200	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3152	cmd.exe
5336	cmd.exe
2560	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_b1e494fa52e748316998a920f24f8500_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBBCCCCCBCCCBBBCABAACCBAACBBBACAABCCACACCBBACBABABBCA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4424	2026-09-06_b1e494fa52e748316998a920f24f8500_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
4424	2026-09-06_b1e494fa52e748316998a920f24f8500_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
4424	2026-09-06_b1e494fa52e748316998a920f24f8500_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
4424	2026-09-06_b1e494fa52e748316998a920f24f8500_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
6124	svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe
6124	svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe
6124	svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe
6124	svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4424	2026-09-06_b1e494fa52e748316998a920f24f8500_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Token: SeDebugPrivilege	6124	svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 3152	4424	2026-09-06_b1e494fa52e748316998a920f24f8500_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	94
PID 3152 wrote to memory of 3332	3152	cmd.exe	96
PID 6124 wrote to memory of 3856	6124	svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe	98
PID 4424 wrote to memory of 5336	4424	2026-09-06_b1e494fa52e748316998a920f24f8500_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	102
PID 5336 wrote to memory of 5968	5336	cmd.exe	104
PID 4424 wrote to memory of 2560	4424	2026-09-06_b1e494fa52e748316998a920f24f8500_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	105
PID 2560 wrote to memory of 3200	2560	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-06_b1e494fa52e748316998a920f24f8500_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_b1e494fa52e748316998a920f24f8500_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCAABCCCABCCBBABBABCBABCBCBCABBACCCBACCBBCBBBBBBABAAABBBCBACCCBCACABCCCACAAABBAACBACBCAAABCACABABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCAABCCCABCCBBABBABCBABCBCBCABBACCCBACCBBCBBBBBBABAAABBBCBACCCBCACABCCCACAAABBAACBACBCAAABCACABABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABCACCCCAABAABCCAAAACBAACBBBBBCCBBBBCBBBBCBABCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe" start= auto displayName= "UserDataSvc_CAABCACCCCAABAABCCAAAACBAACBBBBBCCBBBBCBBBBCBABCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABCACCCCAABAABCCAAAACBAACBBBBBCCBBBBCBBBBCBABCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe" start= auto displayName= "UserDataSvc_CAABCACCCCAABAABCCAAAACBAACBBBBBCCBBBBCBBBBCBABCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABCACCCCAABAABCCAAAACBAACBBBBBCCBBBBCBBBBCBABCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABCACCCCAABAABCCAAAACBAACBBBBBCCBBBBCBBBBCBABCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3200

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCCCCCBCCCBBBCABAACCBAACBBBACAABCCACACCBBACBABABBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCCCCCBCCCBBBCABAACCBAACBBBACAABCCACACCBBACBABABBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe
1⤵
- Executes dropped EXE
PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SubmitGrant.exe

Path C:\Users\Admin\Desktop\SubmitGrant.exe
Size 640KB
SHA256 f23ea7389dff055cde75185b932e595f6b13ee11f22e548ef262a875e6c30abb
MD5 e9e43ce37fdfc649189851663c723853
SHA1 2ef849ddba6186ba70fa4d3c2acc163625438746
SHA512 b5430d24d69a5025b74a90ebd3611fa965750dc1b58eaf76d130fbb11955b29fa67eb7bcdd52d2c575020437619b98b015421216ac125b0a8b3f734d9524e8e1
SSDEEP 12288:mgUFgEsnojA9OCagbgUFgEsnojA9OCagBgUFgEsnojA9gUFgEsnojA9gUFgEsno3:m9+EM0qObE9+EM0qObo9+EM0q9+EM0q1
TLSH
T1E1D43A09F94340B1DD2B10B04DCBD2BF8A60BF2587128EE7F64DDB5B7A32BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e1043e6589c667af016716d144abb6783d604c4837317ad5569f7b704d660d2f
MD5 3b80c251b270cb8fe6c378c815951262
SHA1 b5b5b82d503b4154a1348b99af409cf65b54bfce
SHA512 4d9706ed015158e9f6fb3e4e3a21cbfc1654fa1c174f5378a6284bce4b07c58f8e2e17cece03586e203f090b70a42b7a82e1f54ad96ca2587bb2c8a7a9f69f1d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c2d371ea96bf853efb1fc37127028c29550b8d624a2b0ad3220b64a9246dbec9
MD5 b5b677ff535ea9f11a67a81c755755a2
SHA1 52add7f907901e7240afcd25ddb3a16e0f9b524f
SHA512 326d6ff1a0d816b52f56f1c38ec081d31342d2c2962bc8c2c1e58f5a834a3e616c14df8c91fbd474480c51cfffb1a7e76510ff0814e7d5949afc73ac37f24cd0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c46fe5a9654b33dcbc8b9d7e9caeb4948855200e519801d78599bf552989e31d
MD5 03e6f9c9d88f988df367af4b416b5c81
SHA1 6506e0525e529bd9eab62974753dfff6c387a173
SHA512 0b1cda3014cf03d4d45349df676e1fce1b0ab2053cabae87d849a6af01e7dee3c0cbda4390f0001ecb34423794bf18f9d0ee339975ce5c57b71b1d991cb7a739
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 04caba6e8a8eda2e091579b6cf6d6c5e2d4912608b717f1f0c9453e5030228c6
MD5 1cd99fa3c364b62f6b6b1d549124a863
SHA1 a07af22e5bf7792534cdba9dabd3bc734a55d5ed
SHA512 b35d443aca85fa8c045d42ae60eb5ca48dabd55cab930199ac00dcd775b1f5a1446b9fff17efd93e0c8b4466a995934d301679201932b3dfb692d1eed2bdbedd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 793ca004412d7d1484aeb47f49c5af25dbaba889dde3082d4a6ed6ae8cf9befe
MD5 55e53d1bb7f5397ec9df31d9e6ea830b
SHA1 caac73967bacda744395d6d621ccf20044be2b6f
SHA512 9a4adad2fa8eb22efd5595bd3492bad089d05e8eefeffbd84bfb8e315d2ea1476638befe33b333768d5101dbfeb3d6fcdc62d42a47937090c50e884a98faaf76
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41580c334e87bcf547801f82f592e91e7c7d886639c1197ed6044da53cf06651
MD5 27a51f4bb4e68b271d3044ba40c2873a
SHA1 61ea942d0fea3fc475b457d4336f49b6f87c307f
SHA512 dd4c9c09e3c6b3a631785adefd915b45dc9ff3692d020a676cca13fd1eb35318c8c5197fc71b470bd3e0369a788ed50a1980c456e4a73cab42260d46ac1da04e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a9986c36dacff381fe74b10abbdcfd80645a7f189c302560a14a01b89b045b69
MD5 414ccf66d9679b81b75d7270ff2dd0dd
SHA1 7f0baa11e8c3926f0dbb84396401eaf1b4ab84d6
SHA512 7b23aeca275eccad147f0159552ea0f249687c19e532381c98a285d5f2f23b996c654f9b808c2f3012489f6b8ca0be7d86804c1b188cf16ffc6413dea7fa1618
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4573219132a7c749acbd8c4dfa16ed77c6773d71d89ede980cb509f19bb8537c
MD5 3c7bcc4207db892ebac66c262e11bf4a
SHA1 6f85bcbef681a1855af624e8d274a09bd19550b1
SHA512 1e1a6ff7647bfb995ec9935f022c6c43a3bfd350eb273680b85174556ecb71bccb28e3262fa68b381f17d69391ab97ef208aeefa8ba581177227b211086b70be
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e58519986706a8e5d58113f58ab608e132b2fa5be00112a0b8ecd5dd64bd14f0
MD5 9c284120e2c30ae0ff617ebdb5195573
SHA1 58240c56b57fbebcbb2c92bef2ff8879edae89a2
SHA512 daa7e08125a5601e1a568511f4fbdd55e96fce863aea4420bb1e03dd21e9b5f4e33fd332c08cd49985c170e2612b31243076e3cddaa91e6c82e8d17c26956ebe
MD5 SHA1 SHA512

Submit Download

svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBAACBCBAAAACBCABAABCABABBBCACAACAABBCCCBACBCBBCBA.exe
Size 17.0MB
SHA256 d57ffab5f955d76b1d147edb1c6a20680cbf5a2e95b89a0a8665a2e5e661eeca
MD5 b1e494fa52e748316998a920f24f8500
SHA1 582274146960a47bfde6e0d1e7804fd4432bdc38
SHA512 42430d2a07772a5c3dcbacb65f9e1e0ec9a9fd644d1ff7aeb0e7db878d30cecb5d70a2d0e330d5f8cf1533374b5b6deb84dbf8f5b515cb56b468cbf89ae6c409
SSDEEP 49152:U+EnG+EnK+ES+ES+Ena+ES+EnG+EnK+ES+ES+EnG+EnK+ES+ES+EnX+ES+EnG+E2:9+4jn
TLSH
T1F1074A09F94340B1D92B10B04DCBD2BF8A60BF2587128EE7F78DDB5B7932BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1288-85-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/4424-23-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/4424-71-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/4424-0-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/4424-12-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/4424-49-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/6124-70-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/6124-87-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/6124-48-0x0000000000650000-0x0000000000671000-memory.dmp

Download