519cb11ee4bbb3c5c88a946be87c7f7b9b3103bb2b56bedf171c47bc62d4b555

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_1f3ea8707e023093e54a32005c3d2e09_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 7.4MB
Sample260909-glgbasstc1
SHA256 519cb11ee4bbb3c5c88a946be87c7f7b9b3103bb2b56bedf171c47bc62d4b555
MD5 1f3ea8707e023093e54a32005c3d2e09
SHA1 bf489f2682d622fce6609d6047fc8cfd010c1b3b
SHA512 55197c1d471deff5a97a47cf6b63c3e5069a1b97e80e01b1c07dea316bf6d4b5128f38c9ceb2236d5fce66a405bc8f6b9219244f041a856e3707e93b9599d32f
SSDEEP 49152:U+ES+ESq+ES+ES+ESuB+ES+ESq+ES+ES+ESuB+ES+ESq+ES+ES+ESuB+ES+ESq+C:SOU/jIEeQfoR/IuOFVjUu5H
TLSH
T127766C05F98340B1E92B11B04CDBD3BF8A70BA2587228DFBF78D871B6B32B915425756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
5876	svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBBBBACBCBBABBBABCABAAAABBCBABAABACAACAABCAACBCBCCCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe"	2026-09-07_1f3ea8707e023093e54a32005c3d2e09_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5556	sc.exe
2388	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5456	cmd.exe
564	cmd.exe
5176	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_1f3ea8707e023093e54a32005c3d2e09_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3616	2026-09-07_1f3ea8707e023093e54a32005c3d2e09_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3616	2026-09-07_1f3ea8707e023093e54a32005c3d2e09_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3616	2026-09-07_1f3ea8707e023093e54a32005c3d2e09_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3616	2026-09-07_1f3ea8707e023093e54a32005c3d2e09_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5876	svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe
5876	svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3616	2026-09-07_1f3ea8707e023093e54a32005c3d2e09_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5876	svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 5456	3616	2026-09-07_1f3ea8707e023093e54a32005c3d2e09_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	94
PID 5456 wrote to memory of 4276	5456	cmd.exe	96
PID 3616 wrote to memory of 564	3616	2026-09-07_1f3ea8707e023093e54a32005c3d2e09_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	100
PID 564 wrote to memory of 2388	564	cmd.exe	102
PID 3616 wrote to memory of 5176	3616	2026-09-07_1f3ea8707e023093e54a32005c3d2e09_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-07_1f3ea8707e023093e54a32005c3d2e09_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_1f3ea8707e023093e54a32005c3d2e09_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCBCBBBCAAABBACAACCBBAAAACCCBCAABCBCBABAABCBAACCABBCAAAACACABBAABACBACCACACCBBBAAAABAAABABBBACCCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCBCBBBCAAABBACAACCBBAAAACCCBCAABCBCBABAABCBAACCABBCAAAACACABBAABACBACCACACCBBBAAAABAAABABBBACCCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAAACCCAACBABCABBCCABACCCCCCBCAACCCCBAACBACBACACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe" start= auto displayName= "UserDataSvc_BCAAACCCAACBABCABBCCABACCCCCCBCAACCCCBAACBACBACACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAAACCCAACBABCABBCCABACCCCCCBCAACCCCBAACBACBACACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe" start= auto displayName= "UserDataSvc_BCAAACCCAACBABCABBCCABACCCCCCBCAACCCCBAACBACBACACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAAACCCAACBABCABBCCABACCCCCCBCAACCCCBAACBACBACACAC"
  2⤵
  - Executes a command shell one-liner
  PID:5176
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAAACCCAACBABCABBCCABACCCCCCBCAACCCCBAACBACBACACAC"
    3⤵
    - Launches sc.exe
    PID:5556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CompareMount.exe

Path C:\Users\Admin\Desktop\CompareMount.exe
Size 22.5MB
SHA256 3f05fd2060faa81ed65c93f8f34a1afbee43261d23c30a6222d5cf56fee571f3
MD5 164d669580f8c9702642cf3bada263a3
SHA1 5f48618ce5ad7f87bbc375a7cb20b22435082030
SHA512 eef58388bcfff9e5aa2e03b6c27379803db25453f40d7f7cabb75e01c9cfb402c06c5b3e99524d1df3e55ebb5440cb36d2373fe868d1249da406d1c324de8e39
SSDEEP 98304:SOU/jIEeQfoR/IuOFVjUu5yOU/jIEeQfoR/IuOFVjUu5yOU/jIEeQfoR/IuOFVjr:SFIF0wugFIF0wugFIF0wu3
TLSH
T1CE376C05F98340B1E92B11B04CDBD3BF8A70BA2587228DFBF78D871B6B32B915425756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareMount.exe

Path C:\Users\Admin\Desktop\CompareMount.exe
Size 768KB
SHA256 05cbb9584642128dbaf44c2c17e6fe34a983519c14609f913da0b7761c098e57
MD5 a97d69d54050b72a53099d99d70cf5dc
SHA1 fd1ee3c30f76d7f4a5de0635bf6ecee19e2ae1c2
SHA512 fc97661a75358333caca66e0b1193144264984f6205f26134c513e0952d7c70c87a824cb3642092bff6a92c60d2ca6b189bb94a7367a1d4805ca68c538c5e9cf
SSDEEP 12288:mgUFgEsnojA9gUFgEsnojA9gUIgUFgEsnojA9gUFgEsnojA9gUFgEsnojA9gUmCF:m9+EM0q9+EM0q9I9+EM0q9+EM0q9+EMP
TLSH
T16BF42A09F94340B1D92B50B04DCFE3BF8A60BB2586128DF7FB4DCB5B6933BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareMount.exe

Path C:\Users\Admin\Desktop\CompareMount.exe
Size 640KB
SHA256 a2185124cbec005e33c14571ed93576bc2f41536816d97f7d33e9c8851ef6b3d
MD5 aef866b132dd4757739b0744bd5596db
SHA1 c9e46017a62e936962a95c64aa3a9919cae86e9c
SHA512 d29e46c0837f14dbeaf3cf436245d70fb054ed0fb0a237edfefc5173faf2096b79c57bdf22df9efc70394401c9ae315dad997f78428939b3ceca6d7c6f891cc9
SSDEEP 12288:mgUFgEsnojA9gUFgEsnojA9gUIgUFgEsnojA9gUFgEsnojA9gUFgEsnojA9gUmCb:m9+EM0q9+EM0q9I9+EM0q9+EM0q9+EMl
TLSH
T109D41B09F94340B1D92B50F04DCBD3BF8A60BB25C6128DF7FB4DCB5BA932BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5fd434a74eda43e37c481727330874ae6d3246c12cd0c7ab31d7ecdfb690bd32
MD5 c524f767d16f5f8d82cffa3b095667c4
SHA1 da63b17bcb2fc37e06a3e0b8231ed289b1b2f2aa
SHA512 417a9471a068c9e1a0fd2ac5ecdba59a1e27e5b3d4022361e60548f740c002aaf32b26e57a778e6fe3606993a88497326a520a3bad4caad2ab178abd9fc1768f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 32353d2cdfb25246adb3d4efcdbd3fb54d740be33103246e232322ff1558a73f
MD5 5b221adf3bb9029410f70981f8811882
SHA1 40248507caaef785b3503662fb3cc7c764ff3100
SHA512 b58faec559bc96f1cae0024bd1e0da721bb4e5a55dd8801dc0f3d14632b9aae10eb19a378da6d252eb8ee1df3a8376e20de0f681744368072851b4a49707135b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cdede4f8f1657a0de659d504d7b626421913c628b3040694dd6912aefd9d182b
MD5 00c33c401fa55d903d89cdc0ccd19d50
SHA1 ed8f13f653e586ba8031d9c72ae1ec4c0822237b
SHA512 91d864d708c808d8c05951120c22ffbb9b0f35f8b842a52f7e9f8d0a45b48210cd8a3ceda0181bf8929573b47bd2910c110913f718f932a9d961e82952c1b911
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b5abca2636e7d103d6133b9befcda2b0efcce34e1147a68e7f37842a5f456f2b
MD5 d81d0d3740b9986e7bca125094857329
SHA1 c1e0cee642f34c1572764cc838d2e44d7e030bf9
SHA512 3fdabc14d11abd20853c35f33186ce9ed7097a9d921e027b571aea8038edfae75d3623eb3e4f544e677851eb0669474b3cd042914ecfcf614c6b7939d9b19b95
MD5 SHA1 SHA512

Submit Download

svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe
Size 7.4MB
SHA256 519cb11ee4bbb3c5c88a946be87c7f7b9b3103bb2b56bedf171c47bc62d4b555
MD5 1f3ea8707e023093e54a32005c3d2e09
SHA1 bf489f2682d622fce6609d6047fc8cfd010c1b3b
SHA512 55197c1d471deff5a97a47cf6b63c3e5069a1b97e80e01b1c07dea316bf6d4b5128f38c9ceb2236d5fce66a405bc8f6b9219244f041a856e3707e93b9599d32f
SSDEEP 49152:U+ES+ESq+ES+ES+ESuB+ES+ESq+ES+ES+ESuB+ES+ESq+ES+ES+ESuB+ES+ESq+C:SOU/jIEeQfoR/IuOFVjUu5H
TLSH
T127766C05F98340B1E92B11B04CDBD3BF8A70BA2587228DFBF78D871B6B32B915425756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBAACABBBBACABCBBBABBABAAAABCACCABBCABABBBACCCCCCA.exe
Size 2.3MB
SHA256 4d93395a2ddda039c7603e5e3f42e308284bc03a8f9f8fb00d3fd2c37ade39d4
MD5 9af6b8d8130312a69f65749fc1b992fb
SHA1 2bea9a4c77f1822e35aa160de20203c5d2a792a9
SHA512 734f4c4e726e91edc61bc72e294dc416095abe6a4c19ef16d37188b80e685ee67c04d75e920f727dae8a96b40d09afc8b584d193b23790472e86a14b2b265bd0
SSDEEP 49152:U+ES+ESq+ES+ES+ESuB+ES+ESq+ES+ES+ESuB+ES+ESq+ES+ES+ESuB+ES+ESq+a:+
TLSH
T1DFB52B09F94340B1D92B50B04DCBD3BF8A60BB25C6128DF7FB4DCB5BA933BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3616-34-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/3616-0-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/3616-60-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/3616-23-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/3616-12-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/5876-35-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download

memory/5876-53-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download

memory/5876-74-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download