c3e1b91f617f92a589cf254e0421e04d0196b14776c42bc6b919331867d8c3c2

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 01:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_f7799b41213debfcb7a87d49c12e25a4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 16.8MB
Sample260910-bx95vscl9x
SHA256 c3e1b91f617f92a589cf254e0421e04d0196b14776c42bc6b919331867d8c3c2
MD5 f7799b41213debfcb7a87d49c12e25a4
SHA1 e3bd3c6d6b2b8723d40b6a900ac05d9b3183f837
SHA512 35f084ae75c249fadabf5d06e6168a9cc8a829b881ddafcb8cfae1b91b44c0bd2ad5421c92d61f537e9d731c272cab7aae564df649eded638696ce51e2dbbc91
SSDEEP 393216:F52525L52525L52525L52525L52525L52525L52525L52525L52525r6:F52525L52525L52525L52525L52525Ly
TLSH
T133076C9D7B866122DA2341B18C8AC2F66D7079204B2147EFBA49F72D1F336D0E63B745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2224	svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe
1208	svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe
4516	svchost_CACCABACCABBACBACCBBBBBBABABBBAAACCCBACBBBABBAAACAACBBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBCBCCACACBCBABCAACCBCCAACBBCCBCCCBBBCCBBAACCBBBBCBACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe"	2026-09-08_f7799b41213debfcb7a87d49c12e25a4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBAAAABCAAAACCBCAACCCBABAACACCABCCCBCAACBACAAACCCCCACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCABACCABBACBACCBBBBBBABABBBAAACCCBACBBBABBAAACAACBBC.exe"	svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1360	sc.exe
3300	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1520	cmd.exe
3152	cmd.exe
2468	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_f7799b41213debfcb7a87d49c12e25a4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCABACCABBACBACCBBBBBBABABBBAAACCCBACBBBABBAAACAACBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3100	2026-09-08_f7799b41213debfcb7a87d49c12e25a4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3100	2026-09-08_f7799b41213debfcb7a87d49c12e25a4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3100	2026-09-08_f7799b41213debfcb7a87d49c12e25a4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3100	2026-09-08_f7799b41213debfcb7a87d49c12e25a4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2224	svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe
2224	svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe
2224	svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe
2224	svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	2026-09-08_f7799b41213debfcb7a87d49c12e25a4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	2224	svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3152	3100	2026-09-08_f7799b41213debfcb7a87d49c12e25a4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 3152 wrote to memory of 4900	3152	cmd.exe	94
PID 3100 wrote to memory of 2468	3100	2026-09-08_f7799b41213debfcb7a87d49c12e25a4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	95
PID 2468 wrote to memory of 1360	2468	cmd.exe	97
PID 3100 wrote to memory of 1520	3100	2026-09-08_f7799b41213debfcb7a87d49c12e25a4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 1520 wrote to memory of 3300	1520	cmd.exe	100
PID 2224 wrote to memory of 888	2224	svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-08_f7799b41213debfcb7a87d49c12e25a4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_f7799b41213debfcb7a87d49c12e25a4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBCBCAAAACCCBACBABCBBCCAAAACABCACCAACCACBBABBBBCACAABCCAACBBCCACBCCCACCCBAABCCCBAAABBABCBABCAACCBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBCBCAAAACCCBACBABCBBCCAAAACABCACCAACCACBBABBBBCACAABCCAACBBCCACBCCCACCCBAABCCCBAAABBABCBABCAACCBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBABABCABCBBCBBCACBBBBBABBACCACCBACAAAABCAAAAACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe" start= auto displayName= "UserDataSvc_AABBABABCABCBBCBBCACBBBBBABBACCACCBACAAAABCAAAAACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBABABCABCBBCBBCACBBBBBABBACCACCBACAAAABCAAAAACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe" start= auto displayName= "UserDataSvc_AABBABABCABCBBCBBCACBBBBBABBACCACCBACAAAABCAAAAACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBABABCABCBBCBBCACBBBBBABBACCACCBACAAAABCAAAAACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBABABCABCBBCBBCACBBBBBABBACCACCBACAAAABCAAAAACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3300

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe
1⤵
- Executes dropped EXE
PID:1208

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCABACCABBACBACCBBBBBBABABBBAAACCCBACBBBABBAAACAACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCABACCABBACBACCBBBBBBABABBBAAACCCBACBBBABBAAACAACBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c8719c43a0fa56b33287a2080b67955224b167fec697f855ae13c7d3408a199
MD5 aea0e8c13ebc9e3094391657eca19c54
SHA1 9f210c5b1fd771f1f08b1ea9ed34c221355a0ff2
SHA512 772c15030b4647ec9d60ed1d85937e2152cfd3f4b74132c5d2bcdbaf6d98e6f91ca1fe9520374214665198e53ee6f8589c58a764807b547cb4ef37d322c49c85
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4e673c30bb440dffe340d34e872486b7728e42e8ef52727f3925458fb200fd0d
MD5 ca466760a942496f86b8d55ed6b7ae7b
SHA1 d35184e80d4ab3e47650b1be6d88573ccb4b18c5
SHA512 8f8766758b1e64ea1c00ed98b4f5083b43df67718e7367705243c105eca45d6ec2e34ae29d5967606adb54723254461498ab97076556ddbf935eb8715c3f419b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c6938360bef7de67cb19f4743ceb59e89fd2a480afe84cbd9769039e74ccce8e
MD5 28351430e0c6ea77cbc13884952a2753
SHA1 1d9d6f4ac7f3ce3d082939375ac930a281593944
SHA512 1025797cfb907968606e3d826f02f56711b5dd3313897d0c11760b82ff52c0c6b6232828ffe0e1fd917b290e822a74519b58262de53ce3cc979c19e6a99eb609
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 626fc2c79600b95c693688bb5a0d54088ba4b23c4b0092e8869ba85bcaacb7ba
MD5 0446956152df957a5a1e82f50044de42
SHA1 bfee973a5d3f9fc613987ba40da9d9037644e2d3
SHA512 d1bbc7b77196c3fc98e038ca278f0a52bb08c5a3429ebe247262ef48992d88109253512dba04deb2842fcff76de4302c87d44ce2e1000102d0d337454f985e1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fdaf2a9b1664889c2eb422691a4a2728e6117ab879d46891e06cbd30800af9f1
MD5 9cfa857ecc25b7a0048671f6a69f250e
SHA1 efdc47ede07d8866b55b803e62ffb28d68c7402a
SHA512 1170cdc14f73e2e6f29b1ecfca682bd9f3be1791463f743a96db07943844ceaf05ac33790fa05b0f36293070a723b557d64119891603989440ab942ba5da5022
MD5 SHA1 SHA512

Submit Download

svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABCCCAABCCACCAACBABACBAACBACCCAAABABBABBACCCABACAA.exe
Size 16.8MB
SHA256 c3e1b91f617f92a589cf254e0421e04d0196b14776c42bc6b919331867d8c3c2
MD5 f7799b41213debfcb7a87d49c12e25a4
SHA1 e3bd3c6d6b2b8723d40b6a900ac05d9b3183f837
SHA512 35f084ae75c249fadabf5d06e6168a9cc8a829b881ddafcb8cfae1b91b44c0bd2ad5421c92d61f537e9d731c272cab7aae564df649eded638696ce51e2dbbc91
SSDEEP 393216:F52525L52525L52525L52525L52525L52525L52525L52525L52525r6:F52525L52525L52525L52525L52525Ly
TLSH
T133076C9D7B866122DA2341B18C8AC2F66D7079204B2147EFBA49F72D1F336D0E63B745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1208-67-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/2224-23-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/2224-36-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/3100-0-0x0000000000070000-0x0000000000091000-memory.dmp

Download

memory/3100-7-0x0000000000070000-0x0000000000091000-memory.dmp

Download