ef088372f7d8a55abff07d3b9c9c80ffaf5ecef1f828beb0c21d16a5656f7ff8

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_3dc71167994c948e141199368fb30a22_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe
Size 43.5MB
Sample260907-ff4nzayerc
SHA256 ef088372f7d8a55abff07d3b9c9c80ffaf5ecef1f828beb0c21d16a5656f7ff8
MD5 3dc71167994c948e141199368fb30a22
SHA1 c0a077a6aa81894a606377876c79ddae22119e51
SHA512 a6df6a02221a2bc658ea86c49fc150533a2d7273c62ccb94dcb65dffcc42f071e94d42750cdcf68a09b53e4e4d825dc59001f8e275c99f82a7885f4a675a4e00
SSDEEP 98304:NKjKWQckVgtev5mnlNLq1MbQ9yDAD7KjjqkusjmqMhS:yKWQc0gEYnvLq1tIDewjqkjiqM4
TLSH
T1D2A73B09FD4344F1D92B51B04DCBD3BF8A60BB2587128EE7EA4DCB1B6D23BA15838255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2788	svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe
1616	svchost_BBCABAACBACCBCCBBAABCBABCBBBACABCBBCACCACAAABAACCCABACC.exe
4916	svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAAABABBCBBAACACACABBACABBAACBAABBCBACBBABABBCCAACBCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe"	2026-09-06_3dc71167994c948e141199368fb30a22_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAAABCBBABCBABBBCBABCCCCAAACCBBBBBAABBAACABCACBABACBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCABAACBACCBCCBBAABCBABCBBBACABCBBCACCACAAABAACCCABACC.exe"	svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5884	sc.exe
2016	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2772	cmd.exe
3460	cmd.exe
5220	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_3dc71167994c948e141199368fb30a22_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCABAACBACCBCCBBAABCBABCBBBACABCBBCACCACAAABAACCCABACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1528	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
400	2026-09-06_3dc71167994c948e141199368fb30a22_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe
400	2026-09-06_3dc71167994c948e141199368fb30a22_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe
400	2026-09-06_3dc71167994c948e141199368fb30a22_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe
400	2026-09-06_3dc71167994c948e141199368fb30a22_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe
2788	svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe
2788	svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe
2788	svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe
2788	svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe
1616	svchost_BBCABAACBACCBCCBBAABCBABCBBBACABCBBCACCACAAABAACCCABACC.exe
1616	svchost_BBCABAACBACCBCCBBAABCBABCBBBACABCBBCACCACAAABAACCCABACC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	400	2026-09-06_3dc71167994c948e141199368fb30a22_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe
Token: SeDebugPrivilege	2788	svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe
Token: SeDebugPrivilege	1616	svchost_BBCABAACBACCBCCBBAABCBABCBBBACABCBBCACCACAAABAACCCABACC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 5220	400	2026-09-06_3dc71167994c948e141199368fb30a22_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe	91
PID 5220 wrote to memory of 1528	5220	cmd.exe	93
PID 2788 wrote to memory of 4576	2788	svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe	94
PID 400 wrote to memory of 2772	400	2026-09-06_3dc71167994c948e141199368fb30a22_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe	97
PID 2772 wrote to memory of 5884	2772	cmd.exe	99
PID 400 wrote to memory of 3460	400	2026-09-06_3dc71167994c948e141199368fb30a22_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe	100
PID 3460 wrote to memory of 2016	3460	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-06_3dc71167994c948e141199368fb30a22_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_3dc71167994c948e141199368fb30a22_amadey_elex_glassworm_hellokitty_hijackloader_icedid_luc.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBCABBCABABCABCBCCACACABBCABCABCBAABCCCBCAABBABACACBAAAABAABCCBABCCBBABBCCAACCBACCCCCAABBABCCCBCBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBCABBCABABCABCBCCACACABBCABCABCBAABCCCBCAABBABACACBAAAABAABCCBABCCBBABBCCAACCBACCCCCAABBABCCCBCBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBBCABCCAACBCCACCBCAABCABACBACCCACBABCABAAABCABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe" start= auto displayName= "UserDataSvc_AABBBCABCCAACBCCACCBCAABCABACBACCCACBABCABAAABCABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBBCABCCAACBCCACCBCAABCABACBACCCACBABCABAAABCABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe" start= auto displayName= "UserDataSvc_AABBBCABCCAACBCCACCBCAABCABACBACCCACBABCABAAABCABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBBCABCCAACBCCACCBCAABCABACBACCCACBABCABAAABCABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBBCABCCAACBCCACCBCAABCABACBACCCACBABCABAAABCABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2016

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABAACBACCBCCBBAABCBABCBBBACABCBBCACCACAAABAACCCABACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABAACBACCBCCBBAABCBABCBBBACABCBBCACCACAAABAACCCABACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe
1⤵
- Executes dropped EXE
PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b30e7482f1cb0494aad5bcb5b2901bae3703fc4a2d6d5a40ebcfedb9acbb49be
MD5 3519aeb99f999b3aa87a32206e096790
SHA1 51eff46bc586216a1bac0317c0f1d0ea15683a8c
SHA512 fb7b50423c53aa5e554b4db86d73cd14fe0d71fb190a8929f5749055a81f63438f9b9afbeec7a1fa7ced896a38915c593d445e52b67905b95f46f6ac5e06f73c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f4ade14d48b4c4d1e674102e916efdd6451c3305813fb0ece18b64c70348376f
MD5 10e42b051f08b6da6d429761f0a58b38
SHA1 a5148424f5df2a387731d82e4a705036c8b9baf4
SHA512 e00c323a484d4efaad6cabe2415b2bb6713e1399b222d4910894a5d90bf8c98a98bc68b94a830cb009a08fd48574579acf9d5570b7608ec5478637d81f39d2b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 304b7bdbdc2859048a8277a87e01c7f989d8988384555c38166fcc058c04a4e6
MD5 7aff658c72f1fac7e1ff50bb6eb7ad3d
SHA1 916d735fc3c7bc29bbd1a8acf9f6ce32ae141005
SHA512 0a483049d7d27226adc932a7c108a86eb75c947b6e9eff2387efc794a62330d955a2a62806151eb3e1173ecf87478481452a70726c89223a98a3ce59d3291f42
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b4c90d36e5377ee1f305b653bb2e5e0a6d786013c3d7aae227f6940d7481b994
MD5 cd02a7f124002ed2807b4d51c6c9bcbd
SHA1 14b663e795845f6d5549f706b7fdf9902758188d
SHA512 11690d544c0379fd52a352e904399c637f063c2230652a3b87066235f94a8a09120f2683e3a3f849d822eb7a4b15bfac2e0d6c08cfb6748b0ae3fb546ef05ed5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2bff380b185aae916000a3118389e0653d6aa03c96dca67afbae2ab1e844151a
MD5 efab7ab1eef8e8884b62bd38fa1c6c1e
SHA1 b9d4918278f938aec1a1a8dc0ff282e08cefdfbd
SHA512 ee7af482e4474acba67966cdd3fc8e8300d42eba65bac0b0f50e259452be55ac4613f57ee99e79f1f40be15fb51d6a5615081d80b4d0401dd283c62c40d1358c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a313bdfa3804b33af97ad8090cd5a35ddbcb9b057a9b0a87d6299c4a92397584
MD5 9641b9c674ce50b3dcf2c850547b5cb6
SHA1 c9ff826f466c7261faf4be9948f31611863559ca
SHA512 df025ade1f29a633cb8ec58d040aff7aecf7e9d20603a2b6a0ed8be6cf4e287a690facef69a6b3af9e44ac8b2c40809e80aa1685cc063ecb20dda8d744d788ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6128b270b3be8b3f69b214aaf06578f667a66de323081d010d9806823a925a4e
MD5 99096f80da8e615b48a7948a0e4460b3
SHA1 972c03e2b11e99b68459d138bf734e668c8fdc1c
SHA512 6595b5f9f7270a99e8bb2dd24195a114777bf644281aa54a82ef03b61f06416fae56d506662a7ba2d4c5273c130c109bc70554c01b7d98303f9b8f7605073469
MD5 SHA1 SHA512

Submit Download

svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACABAAACBACBCBCBACCCCCABACCACCBABCAACCCCCBBCCCABABC.exe
Size 43.5MB
SHA256 ef088372f7d8a55abff07d3b9c9c80ffaf5ecef1f828beb0c21d16a5656f7ff8
MD5 3dc71167994c948e141199368fb30a22
SHA1 c0a077a6aa81894a606377876c79ddae22119e51
SHA512 a6df6a02221a2bc658ea86c49fc150533a2d7273c62ccb94dcb65dffcc42f071e94d42750cdcf68a09b53e4e4d825dc59001f8e275c99f82a7885f4a675a4e00
SSDEEP 98304:NKjKWQckVgtev5mnlNLq1MbQ9yDAD7KjjqkusjmqMhS:yKWQc0gEYnvLq1tIDewjqkjiqM4
TLSH
T1D2A73B09FD4344F1D92B51B04DCBD3BF8A60BB2587128EE7EA4DCB1B6D23BA15838255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1c2c59e8acb6ec2e74c52d5b08370c68ff029638ba6e612482e60e82c1ba512a
MD5 b415693d61662e38be708040c37cd308
SHA1 b6fbe4425b688c686c5716ef5ed1f7735191c920
SHA512 b49752df16c0f40bb5e807f70d0dce33a0894af449b2ca70f51c3c2d570aa516ff5ee3df29f49efcfeb56df7fc20c8811223520a78990e0445faa4fabc93102d
TLSH
T16C11E750B475D863E161298F4A29DFCB08A43B8FBC54BB58138D431CB7A9C36CE554E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/400-7-0x00000000005E0000-0x0000000000601000-memory.dmp

Download

memory/400-0-0x00000000005E0000-0x0000000000601000-memory.dmp

Download

memory/1616-68-0x0000000000350000-0x0000000000371000-memory.dmp

Download

memory/2788-33-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/4916-74-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download