1dafa2a4d141a1879971ecc542f0314e321a800d3d4e237bc3e3f7a0f4fdc194

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_77e590a3c251c9149f6d49864f5b3db8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 2.9MB
Sample260910-fd7b3sgl5t
SHA256 1dafa2a4d141a1879971ecc542f0314e321a800d3d4e237bc3e3f7a0f4fdc194
MD5 77e590a3c251c9149f6d49864f5b3db8
SHA1 5f92190999c2417f2d579fabe141ca055988425a
SHA512 2feb6d8d70d2779cba686a72edc7cea8f29b876d0496af61f7e9e93e9d524b6e41ea77cb12119d0e230b85d20e7ba80dd22859e75d0d6f76fa0fd92a7e866e1a
SSDEEP 49152:U+Ek+Ek+Ek+Ek+Ek+Ek+Ek+EZOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfx:JOU/jIEeQfoR/IuOFVjUu5E
TLSH
T156E58D11F9C68072E5B312314CEAC3798674B965873289EFF78C461F5F31AD18A36B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2452	svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe
1056	svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe
3772	svchost_CBCACCAABAABBAAAABCABBCCBBBACBBACBCBBABCBBBBACCCACAACAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACABBAABCCAABAABABBACACBCBBBAACBBABBBBCAAAABACBCCCBBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe"	2026-09-08_77e590a3c251c9149f6d49864f5b3db8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACACCBBABBBACCCAABBBBACBBBBCBCACCBCCBCACCABBAAABCCABCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCACCAABAABBAAAABCABBCCBBBACBBACBCBBABCBBBBACCCACAACAA.exe"	svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4508	sc.exe
3012	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1860	cmd.exe
4132	cmd.exe
3852	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCACCAABAABBAAAABCABBCCBBBACBBACBCBBABCBBBBACCCACAACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_77e590a3c251c9149f6d49864f5b3db8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3976	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1636	2026-09-08_77e590a3c251c9149f6d49864f5b3db8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
1636	2026-09-08_77e590a3c251c9149f6d49864f5b3db8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
1636	2026-09-08_77e590a3c251c9149f6d49864f5b3db8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
1636	2026-09-08_77e590a3c251c9149f6d49864f5b3db8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2452	svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe
2452	svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe
2452	svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe
2452	svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	2026-09-08_77e590a3c251c9149f6d49864f5b3db8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	2452	svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2100	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1860	1636	2026-09-08_77e590a3c251c9149f6d49864f5b3db8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	101
PID 1860 wrote to memory of 3976	1860	cmd.exe	103
PID 2452 wrote to memory of 628	2452	svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe	104
PID 1636 wrote to memory of 4132	1636	2026-09-08_77e590a3c251c9149f6d49864f5b3db8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	105
PID 4132 wrote to memory of 4508	4132	cmd.exe	107
PID 1636 wrote to memory of 3852	1636	2026-09-08_77e590a3c251c9149f6d49864f5b3db8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	108
PID 628 wrote to memory of 4212	628	notepad.exe	110
PID 3852 wrote to memory of 3012	3852	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-08_77e590a3c251c9149f6d49864f5b3db8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_77e590a3c251c9149f6d49864f5b3db8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACAACAABACBBAABCCCBACACAABCCCBAABABBABCACABACCBACBBCBCBAACCCBCBAACACCBBACAABBABABCAACACABCACABAACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACAACAABACBBAABCCCBACACAABCCCBAABABBABCACABACCBACBBCBCBAACCCBCBAACACCBBACAABBABABCAACACABCACABAACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBACCCAACAAACCABBACBABCCCBACBBCABCAABACCBCBCABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe" start= auto displayName= "UserDataSvc_ABCBACCCAACAAACCABBACBABCCCBACBBCABCAABACCBCBCABBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBACCCAACAAACCABBACBABCCCBACBBCABCAABACCBCBCABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe" start= auto displayName= "UserDataSvc_ABCBACCCAACAAACCABBACBABCCCBACBBCABCAABACCBCBCABBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBACCCAACAAACCABBACBABCCCBACBBCABCAABACCBCBCABBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBACCCAACAAACCABBACBABCCCBACBBCABCAABACCBCBCABBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3012

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4212

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe
1⤵
- Executes dropped EXE
PID:1056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAABAABBAAAABCABBCCBBBACBBACBCBBABCBBBBACCCACAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAABAABBAAAABCABBCCBBBACBBACBCBBABCBBBBACCCACAACAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 571472c2e0e186d862508e30dbc5c256074653187f42e711daaa6c0a3fd9971b
MD5 484e2d4680a93a14a0a283d568d28834
SHA1 3d213cf08a6149042431e371bbbe6e46da38afea
SHA512 c5ab95b334666099cd1c83fc8cbedc65f5fc4b1f4546fa8f076462b71dca007d9c59005dba0560e6c4088a5a77f9cfd1986a5e8decb27872b1258c7ea3e46f32
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 debc2d766e724f458523de6a858a72d0bea0f3ffbf1ceacf896dccd6ebbe1673
MD5 87933a02d168d102a76973f339dec1ef
SHA1 a9477fb673039fa293c6e032ec16d6f615b2cac8
SHA512 5e9629b89947a18e5a20ca8a59717d9b4cca6f8b3930db0c996e737bf28d20977add167e0735125e2a4997cab80d0c6b189cb263d0f989785140e40b63eee3c6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a54eb24418273a38b21a2481d9c0fb262b7ac05f43687c2de574a82466d399d4
MD5 a04c289a52a87223c59fa598a0d6c4cc
SHA1 9d09edcc368284e622442e256f6e8628704ea9e5
SHA512 99e46b290838aea0df6b538fb4f3f8535954840def8e90cf3055d6037b4e11b7b0535ff167dfe65f6567cd6387185973338761a99db9a8155e4f8a5dbb994399
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 21ab21ec80a974cebc0bf41f4c2e67f9d6803f53bd13fbba59dbb1451aa7360b
MD5 48c22b960e0af7425fb93f61a9c518bc
SHA1 f54e3e61856e88e908b8db4efc5d3b8c1fc55b57
SHA512 cb325091ef28466ca398130a3dddb69f5dced878ed36312da61a9c2ca32eea16389eb934c84c02973dcb1c87cd5686f170e9821f4a9e0fd0e4016e1360e510c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4bc65899c81607f39749c6a02239c406a37f0adb8fbe793664b39e312eff96e4
MD5 395c0eb0b6bd0294af1c3ffb466bc889
SHA1 a6f8ec60c87ad4df1de4440202dbf13583a24d08
SHA512 a59c67e95751c819267ef31f4f5d3ad87f3e3272cd2dcc56ce2f63da471fa9bfddb91b40094281bec737450255cb93e85522bf638a451cf60c19b74a5ab06464
MD5 SHA1 SHA512

Submit Download

svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACACBBCCCCBACBCBACACABCCABAABBBBABAACAACCBCAAAABCA.exe
Size 2.9MB
SHA256 1dafa2a4d141a1879971ecc542f0314e321a800d3d4e237bc3e3f7a0f4fdc194
MD5 77e590a3c251c9149f6d49864f5b3db8
SHA1 5f92190999c2417f2d579fabe141ca055988425a
SHA512 2feb6d8d70d2779cba686a72edc7cea8f29b876d0496af61f7e9e93e9d524b6e41ea77cb12119d0e230b85d20e7ba80dd22859e75d0d6f76fa0fd92a7e866e1a
SSDEEP 49152:U+Ek+Ek+Ek+Ek+Ek+Ek+Ek+EZOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMjUfx:JOU/jIEeQfoR/IuOFVjUu5E
TLSH
T156E58D11F9C68072E5B312314CEAC3798674B965873289EFF78C461F5F31AD18A36B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-65-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

Download

memory/1056-75-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/1636-0-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/1636-7-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/2452-39-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/2452-26-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/3772-80-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Download