8044c52ca8e123534e3cf36d3ac7527c8bc79590bcc5825f6a065a9f4f58fc52

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_ca78272a74a350b9826ea6cb078bdc97_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
Size 16.1MB
Sample260908-pc573aar2t
SHA256 8044c52ca8e123534e3cf36d3ac7527c8bc79590bcc5825f6a065a9f4f58fc52
MD5 ca78272a74a350b9826ea6cb078bdc97
SHA1 e0e899b8871326501756c5a280c5501b5224b74e
SHA512 9753027ba6b1112b10da6431d81e112f405de65d14bd36050024c42a4bbb49150dfba66d19a5f6bfa641e2e3a323ce60b9ace28e91d7cdad585f87e0f343f6cc
SSDEEP 98304:o1818181818181811OU/jIEeQfoR/IuOFVjUu5O:o1818181818181811FIF0wuo
TLSH
T18F070905F94340B1D82B04B049CBE3BE8760BA25C5134EABF64D8EDFFBF2A915924675
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5400	svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe
3200	svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe
2004	svchost_CCBCCCBCCBBBBCBACCACBCBCACABCACABBBBCCBBAABBACBBBCAABCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACACBCACABCCBCCBABCABAACACCBAABCACCCCAABBABACACBCCAAACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe"	2026-09-08_ca78272a74a350b9826ea6cb078bdc97_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACACACCCABABBBBACCACAABCBACBBACABCBACCCABBABABABAAAAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCCCBCCBBBBCBACCACBCBCACABCACABBBBCCBBAABBACBBBCAABCC.exe"	svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2800	sc.exe
4780	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
716	cmd.exe
1920	cmd.exe
4604	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_ca78272a74a350b9826ea6cb078bdc97_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCCCBCCBBBBCBACCACBCBCACABCACABBBBCCBBAABBACBBBCAABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2428	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6140	2026-09-08_ca78272a74a350b9826ea6cb078bdc97_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
6140	2026-09-08_ca78272a74a350b9826ea6cb078bdc97_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
6140	2026-09-08_ca78272a74a350b9826ea6cb078bdc97_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
6140	2026-09-08_ca78272a74a350b9826ea6cb078bdc97_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
5400	svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe
5400	svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe
5400	svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe
5400	svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe
2004	svchost_CCBCCCBCCBBBBCBACCACBCBCACABCACABBBBCCBBAABBACBBBCAABCC.exe
2004	svchost_CCBCCCBCCBBBBCBACCACBCBCACABCACABBBBCCBBAABBACBBBCAABCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6140	2026-09-08_ca78272a74a350b9826ea6cb078bdc97_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	5400	svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe
Token: SeDebugPrivilege	2004	svchost_CCBCCCBCCBBBBCBACCACBCBCACABCACABBBBCCBBAABBACBBBCAABCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6140 wrote to memory of 716	6140	2026-09-08_ca78272a74a350b9826ea6cb078bdc97_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 716 wrote to memory of 2428	716	cmd.exe	94
PID 6140 wrote to memory of 1920	6140	2026-09-08_ca78272a74a350b9826ea6cb078bdc97_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe	95
PID 1920 wrote to memory of 2800	1920	cmd.exe	97
PID 5400 wrote to memory of 872	5400	svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe	98
PID 6140 wrote to memory of 4604	6140	2026-09-08_ca78272a74a350b9826ea6cb078bdc97_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe	99
PID 4604 wrote to memory of 4780	4604	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-08_ca78272a74a350b9826ea6cb078bdc97_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_ca78272a74a350b9826ea6cb078bdc97_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBCCCACAAABBACBBACACCACACABABCABABCCAAABAACBABBBCACBCBAACBBCACAACBCCAACABBAACBBBBBCBAACBBCBBACACCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBCCCACAAABBACBBACACCACACABABCABABCCAAABAACBABBBCACBCBAACBBCACAACBCCAACABBAACBBBBBCBAACBBCBBACACCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBCAAACCBBCBCACCCCBACBBACCCCBBCBAABCCBAACBBBACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe" start= auto displayName= "UserDataSvc_BBCBCAAACCBBCBCACCCCBACBBACCCCBBCBAABCCBAACBBBACBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCBCAAACCBBCBCACCCCBACBBACCCCBBCBAABCCBAACBBBACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe" start= auto displayName= "UserDataSvc_BBCBCAAACCBBCBCACCCCBACBBACCCCBBCBAABCCBAACBBBACBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCBCAAACCBBCBCACCCCBACBBACCCCBBCBAABCCBAACBBBACBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCBCAAACCBBCBCACCCCBACBBACCCCBBCBAABCCBAACBBBACBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4780

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:872

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe
1⤵
- Executes dropped EXE
PID:3200

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBCCBBBBCBACCACBCBCACABCACABBBBCCBBAABBACBBBCAABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBCCBBBBCBACCACBCBCACABCACABBBBCCBBAABBACBBBCAABCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0e1a02b99ac3c900b0c93618d4c6bae289b4e36b0337cdb23ad7edf921232ef0
MD5 1de109bce2cfc557884cf151459d3815
SHA1 cfd236061895833b6d7cf13994ae453d53a2badf
SHA512 e068302b3498721c35587a6c237f43f193782473f52399258bd965c3c4abe0638d19f3a1c007ec3009b1f5af08ca345c9473fff0cf45d1e669fd2d6ba9d8e053
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0893ecdbcc87e7731a3b6a7acf1f4f81e81d5ead8fb8ce1f9dfef5cbde0eb8ec
MD5 880f58a95c38e696f33b9885ab88c49b
SHA1 8cc261030789eb471fde7ae63f8f4640fd2996ef
SHA512 e05423b63a4d8d355561c05bfa1ab57aad842652a7141059b873fa7097a31518ba4620e7649153d7216add7a3b5fc4bf404d235938eb01a1d4177b765c80f323
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c22f4acb91339a8a6e657db6b76480a50389825dafea1598d1fa51a6dc071abf
MD5 0f348bbba0405c5b88cd8d5736835072
SHA1 74f0d8c40de84bd1e41276df6a67227f66dc67b2
SHA512 06ac31cbeff20e0d592f4b57de07ced0028c323e79f1d197c8a5444bf7964cf4a1c7a6a098ca2ebe174d7290ca1ac26a7bc14990f95d534bd12b3dc5cb8fc458
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5b74bc33b897236523ff5e81117826b2d76fa4d951f56cfa1aea2fc1031cd487
MD5 00d1e34aac0da73b7b5b920c3cd588af
SHA1 c516462687a04c3bf381860a4794c1e020634900
SHA512 6c9da3b7c691fc40e0eae6dc2da5d1502d44263eb376fd3d49c5ff7b5eee35e4ec204f5379277d64d4143c0850d181b09321811d09ab7fdaf6e0a60aa3b61de8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bbac8bfca4df24faba0a79087749a130563b142a155565451649728b15f9224b
MD5 3952bce715e1c0a6ecd0305e67a1b5bd
SHA1 a1cbf667e708de9401d397b21507a7db4d8a22d7
SHA512 bbc639cb91dbb79b1a7a22facb9c00ba4a9c56b6d78dc960862f1265323965491f5eab43902573b0d3486dca99ffe2f7dd733fd596b0cb55b14713991328c070
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 779c098f7f65a0fcf523dc2ba9b218da52642e4076b74f43d4cf0f66b35c9dc2
MD5 3281f62fb704ccfa8a9b2650ec2dcadf
SHA1 437ef28782268ad058850c26443e6e85dddd8fe7
SHA512 8fdec053bd4dba1744dc494913637d01af1672c0eb582cbab99fc7925d81069054ca91e5b685a7ed6ecc6a20652defbb628d973039c0a74d679711a61a89f81d
MD5 SHA1 SHA512

Submit Download

svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAAAABCABABAACCBACBABAAACBCBBAABAABAACBCBACABACCCCCAC.exe
Size 16.1MB
SHA256 8044c52ca8e123534e3cf36d3ac7527c8bc79590bcc5825f6a065a9f4f58fc52
MD5 ca78272a74a350b9826ea6cb078bdc97
SHA1 e0e899b8871326501756c5a280c5501b5224b74e
SHA512 9753027ba6b1112b10da6431d81e112f405de65d14bd36050024c42a4bbb49150dfba66d19a5f6bfa641e2e3a323ce60b9ace28e91d7cdad585f87e0f343f6cc
SSDEEP 98304:o1818181818181811OU/jIEeQfoR/IuOFVjUu5O:o1818181818181811FIF0wuo
TLSH
T18F070905F94340B1D82B04B049CBE3BE8760BA25C5134EABF64D8EDFFBF2A915924675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 29f19a6e016738fcacb10fbeb9b18a2a4bbdfb194cb515a60ba79c046620d632
MD5 02082c6108b4025dd04a53bc4336189a
SHA1 ca164798f743657c24775dd3e10961af4d52de66
SHA512 f0987c2e440b4691d2eaf955a0070fa8fff3eeae4850825be5ab799423285f8c782c861f80a5cc2a3cefb5480c6139287af1c2f83df2be24584b12a6be5a3b84
TLSH
T1CF112741F476C893E43168CB5B35CADB29E43BCA58ACAB1423048219E645C7DCF190E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2004-81-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/3200-67-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/5400-36-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/5400-23-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/6140-0-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/6140-7-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download