f1d3f55e445725afb09dde539b18ccd3d93c3668cf137fe01262fefc127dc576

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 47.7MB
Sample260907-d3dd7aee56
SHA256 f1d3f55e445725afb09dde539b18ccd3d93c3668cf137fe01262fefc127dc576
MD5 505f63f53ee06e1f737d225324912e40
SHA1 2ed3c958af735f89899a98aab1c068d4da88a1e8
SHA512 e38bfa3757303ba8d7e116b7384ee335a62611ed5184b2a7c925f79ddb6bf9ad0a3dd8e61be7f86ee64597189d884d78548623048eb996ffe897ad68ca585a1d
SSDEEP 196608:dKWQc0gEYnvL1KWQc0gEYnvL1KWQc0gEYnvL1KWQc0gEYnvLRFIF0wue:8cZEIv4cZEIv4cZEIv4cZEIvVe
TLSH
T132B74C09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4DCB5B6923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4508	svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe
5816	svchost_BCBACBBCBABACBCBABAABABCBBACABBCCAAACBAACBBCBABCBCAACBC.exe
1752	svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAABACAABACCABAABBBBABCBACBCABBCBBBBBBAABBACBCBBBBABBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe"	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCACABBBBCCACBCACABAACBBCABACACACCAABACAABBCCAAACAACAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBACBBCBABACBCBABAABABCBBACABBCCAAACBAACBBCBABCBCAACBC.exe"	svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5756	sc.exe
1644	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5424	cmd.exe
4856	cmd.exe
2088	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBACBBCBABACBCBABAABABCBBACABBCCAAACBAACBBCBABCBCAACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1516	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1516	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1516	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1516	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4508	svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe
4508	svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe
4508	svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe
4508	svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1516	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4508	svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 5424	1516	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	92
PID 5424 wrote to memory of 2728	5424	cmd.exe	94
PID 4508 wrote to memory of 3912	4508	svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe	95
PID 1516 wrote to memory of 4856	1516	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	98
PID 4856 wrote to memory of 5756	4856	cmd.exe	100
PID 1516 wrote to memory of 2088	1516	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	101
PID 2088 wrote to memory of 1644	2088	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBBBBCACBCCABCCBBCBBACCAABBCBACBCACBABCACAAACCCAACABCAACCBBCACCCBABBBACBCAABBABBBBAAACBBCBBBCABACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBBBBCACBCCABCCBBCBBACCAABBCBACBCACBABCACAAACCCAACABCAACCBBCACCCBABBBACBCAABBABBBBAAACBBCBBBCABACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABCBBBCBCABBAACABACBAAABBBBAABCCCCCACBBCBABBBACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe" start= auto displayName= "UserDataSvc_BCABCBBBCBCABBAACABACBAAABBBBAABCCCCCACBBCBABBBACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABCBBBCBCABBAACABACBAAABBBBAABCCCCCACBBCBABBBACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe" start= auto displayName= "UserDataSvc_BCABCBBBCBCABBAACABACBAAABBBBAABCCCCCACBBCBABBBACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABCBBBCBCABBAACABACBAAABBBBAABCCCCCACBBCBABBBACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABCBBBCBCABBAACABACBAAABBBBAABCCCCCACBBCBABBBACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1644

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACBBCBABACBCBABAABABCBBACABBCCAAACBAACBBCBABCBCAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACBBCBABACBCBABAABABCBBACABBCCAAACBAACBBCBABCBCAACBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe
1⤵
- Executes dropped EXE
PID:1752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8e2dc71d09e27c13396afc2a46d701a356f2bc75719af087843bf3a53fd581dc
MD5 f666b1b306ff73ad5b23ff97c57f1f54
SHA1 99b01ab2f34a513ecd8f70af0249087143b37ee9
SHA512 3943037c89a3cdd238d78b0001bf2e4d54509f62c0ba2616c152ae997126a31e1e855222e49ffea327579372daed8460c01e22ada4271bcd12ee52a0122bba37
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0aae86790afe022bc30d559404a348899a9b8c25fcd8bc3a50491ba05c0f3547
MD5 48724be40d61c29eaeae7bdb7fc42fb8
SHA1 a692b5a176a59b5f798be5dca913bd0ddb2e0f14
SHA512 58922e46e4dfab7149a66797766aaaad341c30c6520ea10ef3078c781ae876e7e59b45fbcb2e081be43d06f66a84b40699c557d825a50c2aa127bfb7959f42e7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e2dc04cfca8a97d4468cc364ca0304452abb9d42214e65615f513b2b8ab58501
MD5 3ccfda13412fc1b18d9351dd3791a085
SHA1 63bb2f68da483c4ed70262e0b4563d699d849da5
SHA512 81ed4f78a3c16770d440b6b694034f8955b062973c9d0f75e49f602e188bb76ab5acbc2961ee75147800fa455404333ed6d1041ed1b58c3fd6c610e607a9b70f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 852faaeb79cef0f1385832047662fcb8fb9e72a05288e59d3f716f2b67e21675
MD5 d138ad9cc3560c9f6b3597ab0a34dc8d
SHA1 898e869f7c9def8b74c1e41a62b2a3de3c56bb92
SHA512 e79d9d55773146b886ea603e77e7bd3a576802c9744ddfc7c73541e3dbc8558a5b1e46185801c2525c7c325e5b1a8697863ee3606ab6bce2366ea88059c1027a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aa0418043046a0afb898c80a10af855156b00f2d1f0f3a0cf034dc2f17ae3024
MD5 bc324e9e23ca466385a91c1d9d7d2c2a
SHA1 22dca7d4151c9cb7cc9046bf77302cf87789ad12
SHA512 79deebaec532fda53e9c785689a1e1e0fb0a1907c49b6a9c42199a354877ca923b6e1f218c9f778e85eb707dcad5091457b8ceaf8eb6bb1e1b4d2bc55d6f7f86
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4038ebe2d95eb71601a3f03d5645c4df8948b48a3bfff0fd2616b00d236f9aa0
MD5 f05816f34208fbc1013909bf412250e1
SHA1 54af741e02c8b6935b4c699cbb5dc7cbee2fbd3b
SHA512 ba885d38f1b4b526fe09fe3008868af3c6ccb635b311c3ead1301c3b123c850ca3a8f77d9cdab3f7bef41db5170f894d52266378829519e0eb74b3ad479725d9
MD5 SHA1 SHA512

Submit Download

svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABACBBBACACABCBBBCAAABBCBCACBACBBAACAAACBBACAAACACBB.exe
Size 47.7MB
SHA256 f1d3f55e445725afb09dde539b18ccd3d93c3668cf137fe01262fefc127dc576
MD5 505f63f53ee06e1f737d225324912e40
SHA1 2ed3c958af735f89899a98aab1c068d4da88a1e8
SHA512 e38bfa3757303ba8d7e116b7384ee335a62611ed5184b2a7c925f79ddb6bf9ad0a3dd8e61be7f86ee64597189d884d78548623048eb996ffe897ad68ca585a1d
SSDEEP 196608:dKWQc0gEYnvL1KWQc0gEYnvL1KWQc0gEYnvL1KWQc0gEYnvLRFIF0wue:8cZEIv4cZEIv4cZEIv4cZEIvVe
TLSH
T132B74C09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4DCB5B6923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1516-0-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/1516-8-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/4508-34-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/5816-65-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download