1c51bbf8da456d688229fbc67c556d0b08334a3b133a067b5b7ed922f3a5ec48

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_587ddd02f9dfa97a1bd78db89ca136fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Size 11.7MB
Sample260907-1ma1fsvsds
SHA256 1c51bbf8da456d688229fbc67c556d0b08334a3b133a067b5b7ed922f3a5ec48
MD5 587ddd02f9dfa97a1bd78db89ca136fe
SHA1 1aa04b74f5e1967a8dc25945d2c227ac2858e302
SHA512 45631a02ab1561ab5da077f42fda32fe1cdce458deba2663d8b5ee6ca6be260e2d1684a71f74ea27ebf6ea61f51a45968b9b79a494c0f4b2d47f01a4d898aaa5
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+ET+Ex+Ex+Ex+Ex+EL:tOU/jIEeQfoR/IuOFVjUu5Q
TLSH
T120C64C0AF98740B1D92B51B00CCBE3BF8670BB2584228E77FB4EC75FBA32B515819655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2140	svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe
4348	svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe
2100	svchost_BBACACBCBCCBCBBABBACABABBCBBAACACCCBCBCACCCABCCCBCAACCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAABABBBCAABBABBBACCCAACCAABABBAAACAACCAACCAAACAACCCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe"	2026-09-05_587ddd02f9dfa97a1bd78db89ca136fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABABCBCBBCAAACBCCBBACCCCACCBCCACACCABBCBAACCBCAACBAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACACBCBCCBCBBABBACABABBCBBAACACCCBCBCACCCABCCCBCAACCC.exe"	svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2288	sc.exe
5840	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6080	cmd.exe
4724	cmd.exe
4444	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACACBCBCCBCBBABBACABABBCBBAACACCCBCBCACCCABCCCBCAACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_587ddd02f9dfa97a1bd78db89ca136fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
548	2026-09-05_587ddd02f9dfa97a1bd78db89ca136fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
548	2026-09-05_587ddd02f9dfa97a1bd78db89ca136fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
548	2026-09-05_587ddd02f9dfa97a1bd78db89ca136fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
548	2026-09-05_587ddd02f9dfa97a1bd78db89ca136fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
2140	svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe
2140	svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe
2140	svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe
2140	svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	548	2026-09-05_587ddd02f9dfa97a1bd78db89ca136fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Token: SeDebugPrivilege	2140	svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 4724	548	2026-09-05_587ddd02f9dfa97a1bd78db89ca136fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	93
PID 4724 wrote to memory of 5104	4724	cmd.exe	95
PID 2140 wrote to memory of 4504	2140	svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe	96
PID 548 wrote to memory of 4444	548	2026-09-05_587ddd02f9dfa97a1bd78db89ca136fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	97
PID 4444 wrote to memory of 5840	4444	cmd.exe	99
PID 548 wrote to memory of 6080	548	2026-09-05_587ddd02f9dfa97a1bd78db89ca136fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	100
PID 6080 wrote to memory of 2288	6080	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-05_587ddd02f9dfa97a1bd78db89ca136fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_587ddd02f9dfa97a1bd78db89ca136fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAAACAAABBCCAACBBBBCBBBCCBCBCCACABBBABCBBBCBBCBCBABBBBBCBACABACCCCBBAABACAABCBCCABAAABACBAAACACBBBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAAACAAABBCCAACBBBBCBBBCCBCBCCACABBBABCBBBCBBCBCBABBBBBCBACABACCCCBBAABACAABCBCCABAAABACBAAACACBBBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBAAAAAACBCABACCABCCACBAACCACCCCACAACACBCBBCBCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe" start= auto displayName= "UserDataSvc_AACBAAAAAACBCABACCABCCACBAACCACCCCACAACACBCBBCBCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBAAAAAACBCABACCABCCACBAACCACCCCACAACACBCBBCBCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe" start= auto displayName= "UserDataSvc_AACBAAAAAACBCABACCABCCACBAACCACCCCACAACACBCBBCBCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBAAAAAACBCABACCABCCACBAACCACCCCACAACACBCBBCBCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBAAAAAACBCABACCABCCACBAACCACCCCACAACACBCBBCBCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe
1⤵
- Executes dropped EXE
PID:4348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBCBCCBCBBABBACABABBCBBAACACCCBCBCACCCABCCCBCAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBCBCCBCBBABBACABABBCBBAACACCCBCBCACCCABCCCBCAACCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 56bdf74ce368a228c9b39257c1b6aaf8b2bf299aabfd68345889412aca742c80
MD5 6f772dff4f19d174ff08aa831cd93117
SHA1 a24a446c1a9189f8967e04474cdcbbe84a577d05
SHA512 33ec7778d97c6fbb789053c1c7ea89bcd9a5392cadb59af03e8f8a435de49f0a45c2d1d57ac9f10935cbdddc05c31635c4fd6b7613fa1e4dee11ccf4264f9ea7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1878238d869f91080d989334fc8dc687c925816817a1d104d6642710519b893f
MD5 a9810370a6dcffb077cd133ad63b5998
SHA1 544cece0975add3cd7eb9f7b7a2dc5e4a40afd70
SHA512 fcecff00180735f6de99baca39b5685443e1c71d6d3f16fe154d4f021db1ff2184fb53de40d6a3a041ee39727e5f1f1738e9fab903c5eefc17b7e9d90486ff5d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 25481ee9f5108c29ce477bc9cf57e388ff362c89eb08feb85c148aa930bd09ab
MD5 36fbcca22157e557e01aaf6b344148ef
SHA1 8f60c4757cd4a8f4ef3e9c0216812ea3ff856077
SHA512 3afb8cbd2193e40cd5bc32cc27e1d51923a90b710f1f5c1205b32e2ac66789e92af51c5452cb51cd9a9db5366d98a02899d4a79c1616376d7082953580a900b5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0fda8418e7316f1a19f158df1cbc4b3dc5c9f59538aa3f3ae3f89e73ddb7580f
MD5 d00717a3861006b2e3f3e6a8ab0f7e56
SHA1 767d82661afb637122241df9d0f42bf0c9eebe4c
SHA512 5fcaf9a474db36af309aed643d7da7c68ab067ac95059d45e65241e5a8b56a2d6b6b6f126cebe97f0a9aef62c653252562bef0831d1679e5dd5dda7c432ae4ce
MD5 SHA1 SHA512

Submit Download

svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABCACBAACCBCCAABCBCABCBABCAAAACBAABCCABBCABACACBC.exe
Size 11.7MB
SHA256 1c51bbf8da456d688229fbc67c556d0b08334a3b133a067b5b7ed922f3a5ec48
MD5 587ddd02f9dfa97a1bd78db89ca136fe
SHA1 1aa04b74f5e1967a8dc25945d2c227ac2858e302
SHA512 45631a02ab1561ab5da077f42fda32fe1cdce458deba2663d8b5ee6ca6be260e2d1684a71f74ea27ebf6ea61f51a45968b9b79a494c0f4b2d47f01a4d898aaa5
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+ET+Ex+Ex+Ex+Ex+EL:tOU/jIEeQfoR/IuOFVjUu5Q
TLSH
T120C64C0AF98740B1D92B51B00CCBE3BF8670BB2584228E77FB4EC75FBA32B515819655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-0-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download

memory/548-7-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download

memory/2140-24-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/2140-34-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/4348-66-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download