c7eb2658d0f5f35aed038314d7ccd58ac3033465e2989833e4e5ecf7be6d67f2

Analysis

max time kernel
151s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_645374bd527a9c58b0e696c89231b446_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Size 18.3MB
Sample260907-ymdp8sba89
SHA256 c7eb2658d0f5f35aed038314d7ccd58ac3033465e2989833e4e5ecf7be6d67f2
MD5 645374bd527a9c58b0e696c89231b446
SHA1 c17b0945f1af25955ac767f61aa18716a06a74b8
SHA512 5da2571cc313182fc776cdc585c599751ee79351d27363ae157340a9787406de3e031d5d27508b920c56b9b8016880095e8fb5bf11741667fda462fb74c83c05
SSDEEP 393216:nIIIHIIIHIIIHIIIHIIIHIIIHIIIHIIIr:r
TLSH
T13F176E05F6818F71D57F0131899AD2B94A7B7D208F218BDBA384BE2EBE316D16934713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1488	svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe
8	svchost_ACBBBACCACABBBCCBBCACCBBCCBBBCAAABACCCCAAACCCBBCBCCCABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBCAABAACCCCACCACAABBBCBBABCABBBACBCCCCAABCACAACCABBAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe"	2026-09-05_645374bd527a9c58b0e696c89231b446_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBABCCCAABBBCBACCCCACCBBBCCBACBABABCCBBBAACCAACBABACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBBACCACABBBCCBBCACCBBCCBBBCAAABACCCCAAACCCBBCBCCCABC.exe"	svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2824	cmd.exe
1836	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBBACCACABBBCCBBCACCBBCCBBBCAAABACCCCAAACCCBBCBCCCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_645374bd527a9c58b0e696c89231b446_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3880	2026-09-05_645374bd527a9c58b0e696c89231b446_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
3880	2026-09-05_645374bd527a9c58b0e696c89231b446_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
3880	2026-09-05_645374bd527a9c58b0e696c89231b446_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
3880	2026-09-05_645374bd527a9c58b0e696c89231b446_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
1488	svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe
1488	svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe
1488	svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe
1488	svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3880	2026-09-05_645374bd527a9c58b0e696c89231b446_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Token: SeDebugPrivilege	1488	svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 2824	3880	2026-09-05_645374bd527a9c58b0e696c89231b446_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	93
PID 2824 wrote to memory of 4408	2824	cmd.exe	95
PID 1488 wrote to memory of 3508	1488	svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe	96
PID 3880 wrote to memory of 1836	3880	2026-09-05_645374bd527a9c58b0e696c89231b446_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-09-05_645374bd527a9c58b0e696c89231b446_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_645374bd527a9c58b0e696c89231b446_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBAABBBAACAACCCCCABACCBBCCAABACBACCBBCBABCBCAABCBCBBBCAABACACCABAAACCCBBCABBBACCCBCCAABACCACACCBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBAABBBAACAACCCCCABACCBBCCAABACBACCBBCBABCBCAABCBCBBBCAABACACCABAAACCCBBCABBBACCCBCCAABACCACACCBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCCACCCBAACCCBCBAABCCBABBABABAACAACABCABCBBACCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe" start= auto displayName= "UserDataSvc_CCCCCACCCBAACCCBCBAABCCBABBABABAACAACABCABCBBACCBCC"
  2⤵
  - Executes a command shell one-liner
  PID:1836

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3508

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBACCACABBBCCBBCACCBBCCBBBCAAABACCCCAAACCCBBCBCCCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBACCACABBBCCBBCACCBBCCBBBCAAABACCCCAAACCCBBCBCCCABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 050e3a835ed496decf3cb5ea6f38498c793ddb3b292c8f4f3e14a07ee01f340b
MD5 9c7798e4ff1a6f5003d74da4468406fa
SHA1 43bf101db8416378514a490b17938c53424fbd3f
SHA512 e72a2c7f4d380893698533fe95cee6688f64eed159883b25ea59f15ab887bb17e7a27b4021c99c7f873a2165ec8c57a96e3f8b54922aed307693bb16f44e77d2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f8feb25f4f0f52c1a5458ca6c9b7678f56e27344e6afceefe1206494fce9068d
MD5 c6c2bea1ef621bbbebea89e79f1d9372
SHA1 93019577c3185bd84c094bc998c55ecf60c1010d
SHA512 95968685f9fb56a5b136b87a97687b1cbb714404cd66b43485e7d519443de12dae851995e2bc0ebb515a9250f911896e3a782b78a309cbe1f6000de00ab0ffb8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 61d163c79cd1f3c7305bd3273250215eb049627db341413fa508eb02ed073c13
MD5 99f631eb97562b25f051567c7da34f91
SHA1 80923a9a01f253fc1daa934fe797c0547dc850f3
SHA512 35e77c821e96283d49a4dca1212252562659968a779655c16a8a6965d03c8bff8748c4ac291baf31c38eeaba8608063352ae458040f171a08e5335f80195106f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 07701a44455e21f40c97986fc1ad2ef02a5b36535a6a7833dc0f4aee700f10cb
MD5 8afe361417a11df7e4e0c5b95b13af57
SHA1 89d050d66b8c43b39269ea0184f94ca50190d79e
SHA512 de49e30c84db2ece21955afaf09cb148a3ef0f0a9310c69b369b3b04dd637b3f65b5fa25b6eb46d3512f00f0e0cfabde9795a8beb08d777cb7913158058ed717
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 efde238c38f2793044e6d7047fc3d10c4219045e9e09b1b0d6be136e3f6a36cf
MD5 b40b68f404951aef656ec4312525a6a3
SHA1 2c18d020853a1843813995a921dc2d5c62bbc942
SHA512 2c365aee747560c75dc5448f33b3b6834e64bc1adfa4661eb7cf6480062c5aa450cd3e4666d81f8f5ef6f93d724a15ff93013c3ef7f04d5c6f1fb50db35535f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aab936ed3a3073b952d7ed05dc34d933fbb3874c95b5c30928c92a508e7d5fac
MD5 189572173d8cefd6400a0d087fc751fc
SHA1 367c5b8152b51d739005512e0066b1cef1343721
SHA512 9a85cb8a434ef28d65d846d0fefae5750a1da5e9b189d1380a77876c76aa20098d64b69e92bbdfef89f519dfdc1016f981aa340be8261f4445f63c8b51873c14
MD5 SHA1 SHA512

Submit Download

svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACAAAACCCACBABCCCABBCCBAABACBACCBBBBCBAACAAABACACA.exe
Size 18.3MB
SHA256 c7eb2658d0f5f35aed038314d7ccd58ac3033465e2989833e4e5ecf7be6d67f2
MD5 645374bd527a9c58b0e696c89231b446
SHA1 c17b0945f1af25955ac767f61aa18716a06a74b8
SHA512 5da2571cc313182fc776cdc585c599751ee79351d27363ae157340a9787406de3e031d5d27508b920c56b9b8016880095e8fb5bf11741667fda462fb74c83c05
SSDEEP 393216:nIIIHIIIHIIIHIIIHIIIHIIIHIIIHIIIr:r
TLSH
T13F176E05F6818F71D57F0131899AD2B94A7B7D208F218BDBA384BE2EBE316D16934713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-65-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/1488-35-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/3880-0-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/3880-8-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download