cc19aad56ff196930b93f7adec430a62fcc2e246a4c9efdfa85e85daf90b3157

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_30b3c33182f30a401a8ca3b11be82b1c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.1MB
Sample260910-hew9lssvb1
SHA256 cc19aad56ff196930b93f7adec430a62fcc2e246a4c9efdfa85e85daf90b3157
MD5 30b3c33182f30a401a8ca3b11be82b1c
SHA1 3f6ca1819d8a8ca2f6018bff6a8065caeba22d3d
SHA512 44914183e0d5bce43f0250f15a444f9aab3e670d3398ae5b244cea24e4d5253350361a52c9c69b6bdccc965b9f995804dbb40b0a7ccf606f9514c4dd24a958cc
SSDEEP 49152:U+E9+E9+E9+E9+E9+E9+E9+E9+EoOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMB:VOU/jIEeQfoR/IuOFVjUu5j
TLSH
T1F5E59D11F9C28072E47311714CAAD37E8A74BA6587328DEFF38C461F5B31AD18A35B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3672	svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe
3876	svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe
2868	svchost_BBACCCCCBAACBCBACCCBCAABCCCCCAABCCCCBABCBABBCCABABCAACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBACCACABBBBAACBCBCACCABABCAABBBCCBCCCAAACBCCACBBCCCBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe"	2026-09-08_30b3c33182f30a401a8ca3b11be82b1c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCACCCABBACACBBBACAABCCCCAAAACBBCCBABAABCAACCCCCCBAAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACCCCCBAACBCBACCCBCAABCCCCCAABCCCCBABCBABBCCABABCAACB.exe"	svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
824	sc.exe
2876	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4572	cmd.exe
4216	cmd.exe
3400	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_30b3c33182f30a401a8ca3b11be82b1c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACCCCCBAACBCBACCCBCAABCCCCCAABCCCCBABCBABBCCABABCAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4240	2026-09-08_30b3c33182f30a401a8ca3b11be82b1c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4240	2026-09-08_30b3c33182f30a401a8ca3b11be82b1c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4240	2026-09-08_30b3c33182f30a401a8ca3b11be82b1c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4240	2026-09-08_30b3c33182f30a401a8ca3b11be82b1c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3672	svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe
3672	svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe
3672	svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe
3672	svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4240	2026-09-08_30b3c33182f30a401a8ca3b11be82b1c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	3672	svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4020	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 4572	4240	2026-09-08_30b3c33182f30a401a8ca3b11be82b1c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	102
PID 4572 wrote to memory of 2164	4572	cmd.exe	104
PID 4240 wrote to memory of 4216	4240	2026-09-08_30b3c33182f30a401a8ca3b11be82b1c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	105
PID 4216 wrote to memory of 824	4216	cmd.exe	107
PID 4240 wrote to memory of 3400	4240	2026-09-08_30b3c33182f30a401a8ca3b11be82b1c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	108
PID 3400 wrote to memory of 2876	3400	cmd.exe	110
PID 3672 wrote to memory of 2060	3672	svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe	112
PID 2060 wrote to memory of 3328	2060	notepad.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-09-08_30b3c33182f30a401a8ca3b11be82b1c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_30b3c33182f30a401a8ca3b11be82b1c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCABABBACCBBCCCAAABCACACACABBCCCAACCACBABACBABCCBBCBCBBCCBBCBABBACABABCBBABBABCABBBCBCABABACBCACCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCABABBACCBBCCCAAABCACACACABBCCCAACCACBABACBABCCBBCBCBBCCBBCBABBACABABCBBABBABCABBBCBCABABACBCACCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAAABCABAACCBABABBACAACBCCBBBABCBACABCCBBBCCBBAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe" start= auto displayName= "UserDataSvc_AAAAABCABAACCBABABBACAACBCCBBBABCBACABCCBBBCCBBAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAAABCABAACCBABABBACAACBCCBBBABCBACABCCBBBCCBBAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe" start= auto displayName= "UserDataSvc_AAAAABCABAACCBABABBACAACBCCBBBABCBACABCCBBBCCBBAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAAABCABAACCBABABBACAACBCCBBBABCBACABCCBBBCCBBAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAAABCABAACCBABABBACAACBCCBBBABCBACABCCBBBCCBBAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3328

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe
1⤵
- Executes dropped EXE
PID:3876

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4020

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCCCBAACBCBACCCBCAABCCCCCAABCCCCBABCBABBCCABABCAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCCCBAACBCBACCCBCAABCCCCCAABCCCCBABCBABBCCABABCAACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 666444d3d74c01b0a5e0cdc0a3e0c59cc055a14473370848b24a7cf9bbe97bbb
MD5 3dccab4217fc64bc17e1c7a4ea162074
SHA1 79b06d8856bdaf1a4c5522dfdcf712380008f428
SHA512 1bbbfe9e581b6d97a25d3c4ca3e24a21c29c8b17c29dac805a7e004ee3759e785c09a185c446b0ec59c621685748be4e5edda51a2457236148e11d6f8908b7df
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2ce2d28e2781f165cbd6dec3106bc537536ba4d85d7ced4df3af6037be91ea62
MD5 d295dce37a30c093e11c45325b55de98
SHA1 a85993bfcca98a64f7c3d6bb76599db9a943e317
SHA512 8b36f9904fb23fb1289bdb9d3c232460000b3c0af5088ce07e15c597b73ceb8c818cd37af20be2eec6f9174399956dba295079322d22af4b97665a9b61f5247f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3cb392d88f6318727e85c7880bfd02b98ae5b46d543d2a7d0786797e81c9397a
MD5 4e43d1f3a31dcde2b838a21d3e10d149
SHA1 66269245ebd8a3a3be2fcd3d35edb7868262b06d
SHA512 59f2acf70611eee967eb9da1e5224f1926fb0677e86207cec20196292bb64a1203dfc5771686c8f3f8a84ed42923d34c42c3b97ce45c483b0bf489c09038ca09
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 042bdcdd63a8d0bdd0cca410b7a5890b501306660a5ebe976af769ceeef36e23
MD5 5bb0c924c700a56c74b9e685effbafd4
SHA1 404fa93f58c44903314359ad2748ed9c24f88d53
SHA512 b104f6d7b606595f19f6a52e277851e8e256ee3ae6c4d84a9ede9dc6b1a335e5b41a7f1c26f8db4dd00f31fe1a94578f2a40f48b0024589f251c914f1d95d884
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e21de150cdd7156f36a1b0de80ea6db5bcc2b3fac7dc1741f692ef2912b86f94
MD5 9a6c50346f19a8356ed21a02f9b4d6e8
SHA1 39996459ac43665c2a5b21d53b8365930713318b
SHA512 e407013541faa04340c3cbc2b4092ad45e0559f4a2a503a65857bb74e34c99c47d8d5b0455d5401a55d6344030a813398e6b40d9d232f92d31b2c347b7460bb8
MD5 SHA1 SHA512

Submit Download

svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACBAACCABCCACCACCBBBBCBACBAACCABBAAAACABACACBCABAB.exe
Size 3.1MB
SHA256 cc19aad56ff196930b93f7adec430a62fcc2e246a4c9efdfa85e85daf90b3157
MD5 30b3c33182f30a401a8ca3b11be82b1c
SHA1 3f6ca1819d8a8ca2f6018bff6a8065caeba22d3d
SHA512 44914183e0d5bce43f0250f15a444f9aab3e670d3398ae5b244cea24e4d5253350361a52c9c69b6bdccc965b9f995804dbb40b0a7ccf606f9514c4dd24a958cc
SSDEEP 49152:U+E9+E9+E9+E9+E9+E9+E9+E9+EoOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMB:VOU/jIEeQfoR/IuOFVjUu5j
TLSH
T1F5E59D11F9C28072E47311714CAAD37E8A74BA6587328DEFF38C461F5B31AD18A35B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2060-67-0x0000000005000000-0x0000000005001000-memory.dmp

Download

memory/2868-80-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/3672-25-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/3672-38-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/3876-74-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/4240-6-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download