126c1d4c22b8cf22eeba357f70c657b3c853a5aa88cd86bbc9513dd26032c7d6

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 16.0MB
Sample260910-cnsd5acp81
SHA256 126c1d4c22b8cf22eeba357f70c657b3c853a5aa88cd86bbc9513dd26032c7d6
MD5 df4c4c128ce5fc48ad697195b8e985e9
SHA1 f9941b303f425d9644f4c3e54e75c01ed31f5c44
SHA512 2a73279c5df2e3e54552f36abf29fa31c21415404cadaa74e860802ded944d9231642b0cf233a44cd4ae88491bf94318117f7339065eec7d499a875bd4e4c790
SSDEEP 98304:/FWuFWuFWuFWuFWuFWuFWuFWuFWqOU/jIEeQfoR/IuOFVjUu51:fFIF0wuf
TLSH
T146F65C46FA8680B2E4370271489B83BB5B70B9154F1296DFB34C936E5F337D0AB32665
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5156	svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe
2936	svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe
692	svchost_BCBCCCBAABACABCBCABCCCACCCBCCBBCCCCAACABBCACCCAAAACAABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBBABACACACCBACAACAAABBACBACABCAACCBCBCCACCCBBACBCABACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe"	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCAACCBBAAAABBBABCBBAACBABBABCBBABBBBCAAACAACBACCCBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCCCBAABACABCBCABCCCACCCBCCBBCCCCAACABBCACCCAAAACAABC.exe"	svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3132	sc.exe
4256	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3484	cmd.exe
5652	cmd.exe
5996	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCCCBAABACABCBCABCCCACCCBCCBBCCCCAACABBCACCCAAAACAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4792	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4792	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4792	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4792	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5156	svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe
5156	svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe
5156	svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe
5156	svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4792	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5156	svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 3484	4792	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	91
PID 3484 wrote to memory of 2596	3484	cmd.exe	93
PID 4792 wrote to memory of 5652	4792	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	94
PID 5652 wrote to memory of 3132	5652	cmd.exe	96
PID 4792 wrote to memory of 5996	4792	2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	97
PID 5996 wrote to memory of 4256	5996	cmd.exe	99
PID 5156 wrote to memory of 4696	5156	svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_df4c4c128ce5fc48ad697195b8e985e9_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAACACBBCBCBCCAACBCABAACABCAABABBACAAACACABACABCBCBACBABABACACABBAAAAABCABCCCCACBBABACBCCABABAAABCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAACACBBCBCBCCAACBCABAACABCAABABBACAAACACABACABCBCBACBABABACACABBAAAAABCABCCCCACBBABACBCCABABAAABCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCBBCCACBBBCCBCCCCCBAABACCBBABBBCACCCCBCBCBAABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe" start= auto displayName= "UserDataSvc_CCBCBBCCACBBBCCBCCCCCBAABACCBBABBBCACCCCBCBCBAABCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5652
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCBBCCACBBBCCBCCCCCBAABACCBBABBBCACCCCBCBCBAABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe" start= auto displayName= "UserDataSvc_CCBCBBCCACBBBCCBCCCCCBAABACCBBABBBCACCCCBCBCBAABCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCBBCCACBBBCCBCCCCCBAABACCBBABBBCACCCCBCBCBAABCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCBBCCACBBBCCBCCCCCBAABACCBBABBBCACCCCBCBCBAABCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4256

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5156
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe
1⤵
- Executes dropped EXE
PID:2936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCCBAABACABCBCABCCCACCCBCCBBCCCCAACABBCACCCAAAACAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCCBAABACABCBCABCCCACCCBCCBBCCCCAACABBCACCCAAAACAABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b761bcb58164a543e357447e0ec6e3caed9785fb8ac2acdf77ff50ea6a58822a
MD5 36c33dfefdc1b574cd38f2a0aa67f642
SHA1 af0f63013ecee387156ad562d88bd9921ec969a0
SHA512 488731fdd1770a1ee1a610b4a86ea64c0a73822f1549d1c198f517cb28aa1fd154ce2dae9ccca684e053bff50b057a01a288d47f630edc474937f59b3ea4465f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3f49120734793dc826b936cd2a811d238bdec5047915dbb07b6b01578f93ad30
MD5 ad786431afab14f0926200c7d81c3e51
SHA1 75596409285d807cd434aba644887cf0333e9312
SHA512 ffe0948045292138984ff1c851cdd71c7132253e2574b102aec3fd18a74e2a3a9864d3b125a721e3db01afede338c31351cb73b16ca87ca54331c642a05776e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 013b4bf8410107d187ff4fc675bf00e98968c321f85f5c400cf610746616f528
MD5 fa4264c06c89cd0b815c48b0b1a9e850
SHA1 c31f986ccb711092e7f9efa14aae5167bb1ceb95
SHA512 38bba0c8670be453cfaf0d4d2db934b4b2a99883699d7aa91f579a82ad648f73023c34acd3c45e6a169f26b819cefe21656918edafac5bb2181223717280702f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 200d48e350fa1823125f9f3ceb7636ec1e65302c602103cf9ed7d9b2186af3af
MD5 7f7d02c1084ce88dd8c5190838a4aade
SHA1 8470e50e6ed6f2d6e3eec366b63617ecc8818991
SHA512 7dd41d81423fa2db10221ff2755f9af80c1d6e0bb360cb4ad5a826b49772999cbad600f80f5aa23ade8d6d9a29ec7b12f693ab2d0d1b7c816d8d044ff458884e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 904e59d8f479e060cd28460e8100e6d8ac5191cf42b73e3d1667c922b0b438eb
MD5 9e6517385fa9a5d2c7565b43a19c8d29
SHA1 7c48008ab3eba5a30d96d654aca711634c0d6ca0
SHA512 b5fd50645e01e90838a73f59b4fe39744a5059b774c88a2fb1b1f17e0b6368f713f23250360cf31c756edf4d1506c51ae3d3bbd9580b62ff11f8e09ef4519603
MD5 SHA1 SHA512

Submit Download

svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBCABABABABAAABCBAABAACCCCCCBBBBAABCACCABBBCAABABACB.exe
Size 16.0MB
SHA256 126c1d4c22b8cf22eeba357f70c657b3c853a5aa88cd86bbc9513dd26032c7d6
MD5 df4c4c128ce5fc48ad697195b8e985e9
SHA1 f9941b303f425d9644f4c3e54e75c01ed31f5c44
SHA512 2a73279c5df2e3e54552f36abf29fa31c21415404cadaa74e860802ded944d9231642b0cf233a44cd4ae88491bf94318117f7339065eec7d499a875bd4e4c790
SSDEEP 98304:/FWuFWuFWuFWuFWuFWuFWuFWuFWqOU/jIEeQfoR/IuOFVjUu51:fFIF0wuf
TLSH
T146F65C46FA8680B2E4370271489B83BB5B70B9154F1296DFB34C936E5F337D0AB32665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-72-0x0000000000490000-0x00000000004B1000-memory.dmp

Download

memory/2936-65-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/4792-6-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/5156-22-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/5156-35-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download