126c1d4c22b8cf22eeba357f70c657b3c853a5aa88cd86bbc9513dd26032c7d6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 16.0MB
Sample260910-cnsd5acp81
SHA256 126c1d4c22b8cf22eeba357f70c657b3c853a5aa88cd86bbc9513dd26032c7d6
MD5 df4c4c128ce5fc48ad697195b8e985e9
SHA1 f9941b303f425d9644f4c3e54e75c01ed31f5c44
SHA512 2a73279c5df2e3e54552f36abf29fa31c21415404cadaa74e860802ded944d9231642b0cf233a44cd4ae88491bf94318117f7339065eec7d499a875bd4e4c790
SSDEEP 98304:/FWuFWuFWuFWuFWuFWuFWuFWuFWqOU/jIEeQfoR/IuOFVjUu51:fFIF0wuf
TLSH
T146F65C46FA8680B2E4370271489B83BB5B70B9154F1296DFB34C936E5F337D0AB32665
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1212	svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe
712	svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe
3388	svchost_AABCAACBCCABBCBCBCAABAAAAAABCAAACAABCBBACBBCABBAABACCAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABCCAABBBAABAAACCACBACACBBBBAACACBACBACAABCABAACAABCAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe"	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBCBAAAAABAABACAABBAABBCBABAAACCBAABACCCCAAABBAABBBCABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCAACBCCABBCBCBCAABAAAAAABCAAACAABCBBACBBCABBAABACCAC.exe"	svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4816	sc.exe
2324	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4556	cmd.exe
2668	cmd.exe
1688	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCAACBCCABBCBCBCAABAAAAAABCAAACAABCBBACBBCABBAABACCAC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1360	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1360	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1360	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1360	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1212	svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe
1212	svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe
1212	svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe
1212	svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1360	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1212	svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3716	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 4556	1360	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 4556 wrote to memory of 5032	4556	cmd.exe	100
PID 1212 wrote to memory of 2300	1212	svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe	101
PID 1360 wrote to memory of 2668	1360	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	102
PID 2300 wrote to memory of 720	2300	notepad.exe	104
PID 2668 wrote to memory of 4816	2668	cmd.exe	105
PID 1360 wrote to memory of 1688	1360	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	106
PID 1688 wrote to memory of 2324	1688	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABAABACACABCACBBBBCCAACBACCCCCAAACABBABBABBABBCCCBBABBBABACBABBCCCBAAAACBBBBACCBBBABBCCAABCACABABCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABAABACACABCACBBBBCCAACBACCCCCAAACABBABBABBABBCCCBBABBBABACBABBCCCBAAAACBBBBACCBBBABBCCAABCACABABCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACACABCAABABAAABCBAAABACABBBACACAABBACAACABCAACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe" start= auto displayName= "UserDataSvc_CBACACABCAABABAAABCBAAABACABBBACACAABBACAACABCAACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACACABCAABABAAABCBAAABACABBBACACAABBACAACABCAACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe" start= auto displayName= "UserDataSvc_CBACACABCAABABAAABCBAAABACABBBACACAABBACAACABCAACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACACABCAABABAAABCBAAABACABBBACACAABBACAACABCAACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACACABCAABABAAABCBAAABACABBBACACAABBACAACABCAACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe
1⤵
- Executes dropped EXE
PID:712

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACBCCABBCBCBCAABAAAAAABCAAACAABCBBACBBCABBAABACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACBCCABBCBCBCAABAAAAAABCAAACAABCBBACBBCABBAABACCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 832fca7dc77113cbb427f4c426ee735846ce0ea0b8e3fba537e23c0ef382c418
MD5 bdd9a65bd6426e9d472bf7dd437394e1
SHA1 94cb1a9ab886e927851de33bfd038e5387b40239
SHA512 548fe30ee4501704661f2e0d3400019c76432a28ff5724949f7a6163813bafaff8e050a70a74dcfb364ac8c1b30350ac5f1fe222a32ba262aaace04756644801
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 11e11affbb069803646a66fc84b65bbc0ed416e5061ddca022e0caf603576fbe
MD5 964ad91fff72c2a735644d9f24dd8883
SHA1 d81e6a5963c865bc40f1f7bee394cd9428a8c8d3
SHA512 1dc0f099f6d4c6cf802d4505b3c9bf2582eea0377aff1ece12cb35f698a4b55744fdadd5a19e307448bc956f4bd45d369accdef4e77fa84983b743b7723adc23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 746e9866dae085fd873b25bd1d02e6f7eac0daf47b6431250cc76e7b1cac0563
MD5 bfb3a3d0e48c160b2a837053facd3d09
SHA1 598eff7b25f5c4746e835de130e2ae3b12be9970
SHA512 55836cdacc0c15c52dd5658216405f2558cf84d0bf539a4468ea13bd882d63a85b687e96b5eee711ffcfc3f2036371c2ef2ba384f63521c4dd9bb6d22c5c8c0b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2b52f4ba0d5a743af0eb41b49a790eeeb38ce65726be7920ebe4082b07dc73bb
MD5 f1ab8cbcd5480580bbffff47653797e2
SHA1 6422e6f917433559713ec3c15a09f1376879d81c
SHA512 065333238447fcc7dafd99a9f72d5e4888f4d367bd71aa6a66c348c164cab00be959c7f6718e49b8abba6263ca423ac923a33f7f46b883bc1dfd8e2e8de42552
MD5 SHA1 SHA512

Submit Download

svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACABABBABCCCBCBACACAAAABCAACBACACAACCAACBBACCCBCCA.exe
Size 16.0MB
SHA256 126c1d4c22b8cf22eeba357f70c657b3c853a5aa88cd86bbc9513dd26032c7d6
MD5 df4c4c128ce5fc48ad697195b8e985e9
SHA1 f9941b303f425d9644f4c3e54e75c01ed31f5c44
SHA512 2a73279c5df2e3e54552f36abf29fa31c21415404cadaa74e860802ded944d9231642b0cf233a44cd4ae88491bf94318117f7339065eec7d499a875bd4e4c790
SSDEEP 98304:/FWuFWuFWuFWuFWuFWuFWuFWuFWqOU/jIEeQfoR/IuOFVjUu51:fFIF0wuf
TLSH
T146F65C46FA8680B2E4370271489B83BB5B70B9154F1296DFB34C936E5F337D0AB32665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-27-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/1212-40-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/1360-0-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download

memory/1360-7-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download

memory/2300-65-0x0000000003060000-0x0000000003061000-memory.dmp

Download