461cfa48ae8e49ff61c5d08f9bf20b0c44f091e94a2717557e5f1d24bd0a688e

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_953ee425362611480bb896fdf1320159_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 17.8MB
Sample260907-n6vsrawdqc
SHA256 461cfa48ae8e49ff61c5d08f9bf20b0c44f091e94a2717557e5f1d24bd0a688e
MD5 953ee425362611480bb896fdf1320159
SHA1 2fe6a7aa59708193bfde87f7471940470855193a
SHA512 a073a3ac593650725add7c51aeecca056d3cc77befb5b8e1a9fad6eaf929fb27946a75f29623cca889c24ce6a829a7221fbd690616631929382413091f73f6c8
SSDEEP 49152:U+En+En+En+En+E1U+En+En+En+En+E1U+En+En+En+En+E1U+En+En+En+En+EQ:ZOU/jIEeQfoR/IuOFVjUu5C
TLSH
T154174B09F94340B1D92B51B04DCBD3BF8A60BB2587224EF7FB4DCB1B6A32BA15438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5624	svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe
6560	svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe
576	svchost_ACAABBBCCBCCCABABAAAACACABCBABCCCACACBBBBCABBAAACBBCABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABBCAABACBCBCAACAACBCCBABBCCCAABBAACABBCAABCCACAAABCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe"	2026-09-05_953ee425362611480bb896fdf1320159_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAAAAABBACAAABBBBCACCCAABBACBBBBACABABABCCBBBCACCACBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAABBBCCBCCCABABAAAACACABCBABCCCACACBBBBCABBAAACBBCABB.exe"	svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6836	sc.exe
6624	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6124	cmd.exe
3936	cmd.exe
1548	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_953ee425362611480bb896fdf1320159_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAABBBCCBCCCABABAAAACACABCBABCCCACACBBBBCABBAAACBBCABB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5556	2026-09-05_953ee425362611480bb896fdf1320159_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5556	2026-09-05_953ee425362611480bb896fdf1320159_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5556	2026-09-05_953ee425362611480bb896fdf1320159_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5556	2026-09-05_953ee425362611480bb896fdf1320159_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5624	svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe
5624	svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe
5624	svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe
5624	svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5556	2026-09-05_953ee425362611480bb896fdf1320159_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5624	svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5556 wrote to memory of 6124	5556	2026-09-05_953ee425362611480bb896fdf1320159_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	93
PID 6124 wrote to memory of 1980	6124	cmd.exe	95
PID 5556 wrote to memory of 3936	5556	2026-09-05_953ee425362611480bb896fdf1320159_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	96
PID 3936 wrote to memory of 6836	3936	cmd.exe	98
PID 5556 wrote to memory of 1548	5556	2026-09-05_953ee425362611480bb896fdf1320159_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	99
PID 1548 wrote to memory of 6624	1548	cmd.exe	101
PID 5624 wrote to memory of 3240	5624	svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-05_953ee425362611480bb896fdf1320159_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_953ee425362611480bb896fdf1320159_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABACCCCBCCBBABBABACCBCBCAAAABACABAACCBAAABCCBBACBCABBCCBCABAAAAACAAAAAACAAABBBBCABCBABCCCABCABBCABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABACCCCBCCBBABBABACCBCBCAAAABACABAACCBAAABCCBBACBCABBCCBCABAAAAACAAAAAACAAABBBBCABCBABCCCABCABBCABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCBCBCCACBACCAAAAACCBBACBBCCAACCBAABABBCCBBCBBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe" start= auto displayName= "UserDataSvc_CBBCBCBCCACBACCAAAAACCBBACBBCCAACCBAABABBCCBBCBBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCBCBCCACBACCAAAAACCBBACBBCCAACCBAABABBCCBBCBBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe" start= auto displayName= "UserDataSvc_CBBCBCBCCACBACCAAAAACCBBACBBCCAACCBAABABBCCBBCBBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCBCBCCACBACCAAAAACCBBACBBCCAACCBAABABBCCBBCBBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCBCBCCACBACCAAAAACCBBACBBCCAACCBAABABBCCBBCBBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6624

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5624
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe
1⤵
- Executes dropped EXE
PID:6560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABBBCCBCCCABABAAAACACABCBABCCCACACBBBBCABBAAACBBCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABBBCCBCCCABABAAAACACABCBABCCCACACBBBBCABBAAACBBCABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 93dba34ae8c993fb8f6a4d92424a24a095b46ef9651338e036a2f7fce05b75f2
MD5 eed6c878e5e4a5e064bc8cdfab9a0f66
SHA1 3c7aa2947fb01f9fd9708bb52b64ec2b4b7aa3d9
SHA512 5b37a18c0b5c4734f2ec356ee3a5c544a1f57cca4456858ac2c6b3c45a1f9644d6a00ba770b48cd804f45c642fb7a6cd82b98203d6aef9f3e53f7e6e1e40ccb1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 81671e82cd51459cc96f10ff1c593a9bcb195ad43c6b7aeb64219ecaa4ee7b14
MD5 4ffc685637f15ee28b3ae90fee58612e
SHA1 c1c21ca4bc60ed5af4a53df6f497d2e3f4f58af8
SHA512 15e6b9f0a31eaa116f1aef55f024f0c5bb2b3cf9157d2a5c5389815fa59b7d6ec06536f41f36699a7d60a3b0bdfe7a7ed3a640d772710fc7bb4ab0c39db7d7ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b033003adf390ede29c4649e70bc54decc3c7c4ecac3467076f34a8eba0a77c4
MD5 9dce2afbcd2d5edda6a2776cf6ad0cfb
SHA1 43724632ae9447f1e9d623466256e2a746869ff6
SHA512 c191bc225ae562aa51386da3806a188c3ca7e9d35b11c22f3513176161964f5b79c08edbe40a081aa012aecc764b1db3cfd04455ad9799c1ea69963802ef8238
MD5 SHA1 SHA512

Submit Download

AssertEnable.exe

Path C:\Users\Admin\Downloads\AssertEnable.exe
Size 384KB
SHA256 fb34b7b8b14d87e7ceba73ad5bd8b075d3fb1a8aaf8bc1cfd72e7ff54e812924
MD5 019ef238258ba5f60e47ca7e80b92298
SHA1 61a2d4ac0ddedfc57e4729ffe88506700d771bce
SHA512 f78a0e912190186ff1913b0abb70af7fd7ce5692dea4930c6690cf317e7b4903441c0fd1b4deb10ea58da45faa19712eba48125f4be2a2af6834a68f52ef6fed
SSDEEP 6144:m+dTTUFgEs3XojAdQ+dTTUFgEs3XojAdQ+dTTUFgEs3XojAdQ+dTTUFgEs3XojAc:mgUFgEsnojAOgUFgEsnojAOgUFgEsnor
TLSH
T100841B09F94340B1D92B51F04DCFE3BF8A60BB2586128EF7FB4DCB5BA523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fe51c5ef203c2058976d2c6b048271d8b7618751fca9cd5eafb1c6f827fc56ec
MD5 25747b5e276641d9b72f576942ba38ff
SHA1 ce55efbb5bc6e14a558db354de58b9acab204e57
SHA512 16bee4121e7d0dee2477cb81fa455c7ba2d1f0cf2381909c6bd92b0514013c8fbe7b69cad73eac22ed063071e4486e3ac03e7ef521a746263faedf1b2a9b46fd
MD5 SHA1 SHA512

Submit Download

svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACACCACBBBCCCACAAACCABCACCBCABCBBBACACACBABAABBAACA.exe
Size 17.8MB
SHA256 461cfa48ae8e49ff61c5d08f9bf20b0c44f091e94a2717557e5f1d24bd0a688e
MD5 953ee425362611480bb896fdf1320159
SHA1 2fe6a7aa59708193bfde87f7471940470855193a
SHA512 a073a3ac593650725add7c51aeecca056d3cc77befb5b8e1a9fad6eaf929fb27946a75f29623cca889c24ce6a829a7221fbd690616631929382413091f73f6c8
SSDEEP 49152:U+En+En+En+En+E1U+En+En+En+En+E1U+En+En+En+En+E1U+En+En+En+En+EQ:ZOU/jIEeQfoR/IuOFVjUu5C
TLSH
T154174B09F94340B1D92B51B04DCBD3BF8A60BB2587224EF7FB4DCB1B6A32BA15438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5556-11-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/5556-22-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/5556-84-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/5556-34-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/5556-0-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/5556-60-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/5624-51-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/5624-72-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/5624-33-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/6560-87-0x0000000000610000-0x0000000000631000-memory.dmp

Download