667ad3d4a2408ec58e3b02cde9f15ac0b0688a2ee98f091b772416178d0dafa7

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_dcb430ee4848f38d10211ca32bdc4216_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 10.1MB
Sample260910-lt2z7avsbv
SHA256 667ad3d4a2408ec58e3b02cde9f15ac0b0688a2ee98f091b772416178d0dafa7
MD5 dcb430ee4848f38d10211ca32bdc4216
SHA1 1efcfadcf0cbde242df8ae169412f6b8d86dc13b
SHA512 b0a3632c3192880aff77c561d7d8b0dc9e570c60724c050e322bb1f0948bf1a96b696005c68dae67b645edf16496ca6bf6f02d0cb1f9a80d5add8c67151e0cf4
SSDEEP 98304:a+Q+Q+Q+Q+Q+Q+Q+Q+GKjKWQckVgtev5mnlNLJ:7KWQc0gEYnvLJ
TLSH
T138B67D09F68640F1D4774170889782BB8B71B8255B229BDFA398C37E9E337D0BA35B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4168	svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe
2416	svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe
924	svchost_BCAAACACABBABBACCABABBBCACAABAABCABACCACBCCBABABBCCCABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAACCACAAABBBACAACBAAAABBABBACCCABAABBCBABACABACABBBCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe"	2026-09-10_dcb430ee4848f38d10211ca32bdc4216_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACCCBBABCCCBBCAAABAABCCAACCACAACCBAAAAAABCBBACCACAAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAAACACABBABBACCABABBBCACAABAABCABACCACBCCBABABBCCCABB.exe"	svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3192	sc.exe
2076	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4888	cmd.exe
2472	cmd.exe
704	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAAACACABBABBACCABABBBCACAABAABCABACCACBCCBABABBCCCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_dcb430ee4848f38d10211ca32bdc4216_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3272	2026-09-10_dcb430ee4848f38d10211ca32bdc4216_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3272	2026-09-10_dcb430ee4848f38d10211ca32bdc4216_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3272	2026-09-10_dcb430ee4848f38d10211ca32bdc4216_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3272	2026-09-10_dcb430ee4848f38d10211ca32bdc4216_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4168	svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe
4168	svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe
4168	svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe
4168	svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe
924	svchost_BCAAACACABBABBACCABABBBCACAABAABCABACCACBCCBABABBCCCABB.exe
924	svchost_BCAAACACABBABBACCABABBBCACAABAABCABACCACBCCBABABBCCCABB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3272	2026-09-10_dcb430ee4848f38d10211ca32bdc4216_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4168	svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe
Token: SeDebugPrivilege	924	svchost_BCAAACACABBABBACCABABBBCACAABAABCABACCACBCCBABABBCCCABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 4888	3272	2026-09-10_dcb430ee4848f38d10211ca32bdc4216_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	91
PID 4888 wrote to memory of 2996	4888	cmd.exe	93
PID 3272 wrote to memory of 2472	3272	2026-09-10_dcb430ee4848f38d10211ca32bdc4216_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	94
PID 2472 wrote to memory of 2076	2472	cmd.exe	96
PID 3272 wrote to memory of 704	3272	2026-09-10_dcb430ee4848f38d10211ca32bdc4216_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	97
PID 704 wrote to memory of 3192	704	cmd.exe	99
PID 4168 wrote to memory of 4488	4168	svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-10_dcb430ee4848f38d10211ca32bdc4216_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_dcb430ee4848f38d10211ca32bdc4216_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBACBBBCACBBBBCBAABCAABAAABCCCBBCBCACBAABCBBACCAABCABAABCABBCACBBAACBBBCAAACCCCCAABBBAABBBBBAABAACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBACBBBCACBBBBCBAABCAABAAABCCCBBCBCACBAABCBBACCAABCABAABCABBCACBBAACBBBCAAACCCCCAABBBAABBBBBAABAACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABCCBAACACBACBABBACCCAAACABABBBCAACACBBACBCCABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe" start= auto displayName= "UserDataSvc_CCABCCBAACACBACBABBACCCAAACABABBBCAACACBBACBCCABBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABCCBAACACBACBABBACCCAAACABABBBCAACACBBACBCCABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe" start= auto displayName= "UserDataSvc_CCABCCBAACACBACBABBACCCAAACABABBBCAACACBBACBCCABBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABCCBAACACBACBABBACCCAAACABABBBCAACACBBACBCCABBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABCCBAACACBACBABBACCCAAACABABBBCAACACBBACBCCABBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3192

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe
1⤵
- Executes dropped EXE
PID:2416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACACABBABBACCABABBBCACAABAABCABACCACBCCBABABBCCCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACACABBABBACCABABBBCACAABAABCABACCACBCCBABABBCCCABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1a64dab012489c0260a06efcaf75aaf3f8d48fe906953513cc42240ea4c3b016
MD5 fedee2a88043f732c00a5fbeee48f80a
SHA1 24f66a35dbf7f9a9dfa2080c2c50c1423796ae39
SHA512 1fbf8cc963d67f71f15afec195d5727b731c82c1c69992de6a583f60baab6508363b0b612fc3b1c7f46deb1ff7c4bd6b7fef1a1ceca67f83cca51cefebca61c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d19e4666b049108890ac0f7060f1b8f71d232cfa8b65d677dc2e0ea2c7c76058
MD5 64a3ec05c92a4e3d4b6563a3f082e2be
SHA1 f62116ff1d15cf9c2c36bc5a8c01be66fe482ec8
SHA512 7371b40c1616aa4391922b1473328f1bd5ea448cd8ebc3be24ab34c20f6cfeeb2587185c244eacec57941dd6dfec3a892ea89c6b2d03c10f21b4f2fb11b20c64
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 38cf5bc4aed04d2935585453353050b1368ba3e9135b55b84ee76ae91369f70a
MD5 64c8024fecd4d34c72a13341ea41ed1d
SHA1 79a8a05bfff66c5345735e6bfcf4307788e5b78b
SHA512 4eb144a383948f38406dfb3f2ede36925d031f66e024865285e52564978ab04525b1541eb2293498274d29e6f5f03790f6716f4257a1c62d4af32ec2ab7fc711
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4fcbe77cffdd1fd234c170664732214b9c14dd03236a421f5b477d86f5effe34
MD5 88816c9cb81f16e8f83e9086bbc60964
SHA1 d0b29ce9754652c31a33860c64ad9ff7244b1c05
SHA512 f374b8072ea16d62f3e89d6dc50802dc599b5cdbe7745563924835b2b43a4eb35bb6ab067b13b5e0aaf3340537226fd3d41ff0af67d441e993ecf32e88453035
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 279681a175d407f6b9f126dfc1566166b590e7200699f42fbf7f4f484a0109a4
MD5 7aacc3a1e8d99fd102c79793bfa5867a
SHA1 b6909da0f1c17e706d65dee5cae19c1f1ff930fe
SHA512 6e849f5b028c57e95ba1b40dc5c7dad74217c8e3047a7711dceb30e097057b75b6f8cb247baf8e3c76ab49aed2575781a3912c2e0ab4c400a584b26a143ac39d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a06a30ed3249b8dce45d2ae5f75479750159a5bae6d269b44f52997adfae3e54
MD5 69f7bc11f60e15a6f1eefd9b57fb5a3c
SHA1 3e37f7b8b4a4057e74e6fd1de34578899bd520ed
SHA512 3024cf0f0a596201aad878c6d8d951f35308c096d30237e42bcb906d11a9ba4ccb2808cce73521fccb532ca067a2937066289cb2f461fe19d7e9bcbf56839be4
MD5 SHA1 SHA512

Submit Download

svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABACAABBCBCBACCCAACAACABCAABCBBCCAACBCACCCBBBBB.exe
Size 10.1MB
SHA256 667ad3d4a2408ec58e3b02cde9f15ac0b0688a2ee98f091b772416178d0dafa7
MD5 dcb430ee4848f38d10211ca32bdc4216
SHA1 1efcfadcf0cbde242df8ae169412f6b8d86dc13b
SHA512 b0a3632c3192880aff77c561d7d8b0dc9e570c60724c050e322bb1f0948bf1a96b696005c68dae67b645edf16496ca6bf6f02d0cb1f9a80d5add8c67151e0cf4
SSDEEP 98304:a+Q+Q+Q+Q+Q+Q+Q+Q+GKjKWQckVgtev5mnlNLJ:7KWQc0gEYnvLJ
TLSH
T138B67D09F68640F1D4774170889782BB8B71B8255B229BDFA398C37E9E337D0BA35B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 305d2006653a6266cc6c99de1587b8c0cd4299a1558920f6562f9f01c8ffcc87
MD5 cdfe569af33dfc4c41a8c3c43aa66faa
SHA1 6a27e6926e4f5d7f14626e7c1a9e5056c2822487
SHA512 e08457fa4ed22719c76ab60c4288258006fa6183be143f634ab21ae89541315eb28bac631a072bc5f7256e90acc7b11c1b49ceea6d335627032e79c7baeae598
TLSH
T17111E776B0A5D813F0716982622AEF5A1CBC37FB58DCAB186305812CE715D35CD550E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/924-72-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/2416-66-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/3272-6-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/4168-35-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/4168-22-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download