673c68521aae1ccda9f80c7cd9dc2ba3324b3a81d38f6ca59be567b556964930

General

Target
2026-09-10_a3d6be9a75d3487fbfdec5c35536bc36_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Size 52.4MB
Sample260910-psd4hscl4z
SHA256 673c68521aae1ccda9f80c7cd9dc2ba3324b3a81d38f6ca59be567b556964930
MD5 a3d6be9a75d3487fbfdec5c35536bc36
SHA1 c20999f99135b40abc28f4d85e9e8880d37576f5
SHA512 0a01d304bf67dc4dc0427c060f383ae3adb6eb183db85f6f8b525e32fa08dca03a67fe43db412d620fdbf436b03fac400134554e44cc1ab779dac3f08e6d55ee
SSDEEP 49152:U+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+Et:Op7Ep7Ep7DOU/jIEeQfoR/IuOFVjUu5W
TLSH
T1F2C72A09FD4340B1D92B51B04DCFE3BF8A60BB2586128DF7FB4ECB5B6523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
3616	svchost_CBBCCBCAAACAACACBBBACCACABAABCBCABBABBBCACCCAAACCBAAAAA.exe
3700	svchost_CBBCCBCAAACAACACBBBACCACABAABCBCABBABBBCACCCAAACCBAAAAA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBBABCAABCACABACCACBBACBACBBABABACCBBACBBAAAACAABBACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCCBCAAACAACACBBBACCACABAABCBCABBABBBCACCCAAACCBAAAAA.exe"	2026-09-10_a3d6be9a75d3487fbfdec5c35536bc36_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2764	sc.exe
2816	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4304	cmd.exe
2324	cmd.exe
5748	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCCBCAAACAACACBBBACCACABAABCBCABBABBBCACCCAAACCBAAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_a3d6be9a75d3487fbfdec5c35536bc36_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4916	2026-09-10_a3d6be9a75d3487fbfdec5c35536bc36_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
4916	2026-09-10_a3d6be9a75d3487fbfdec5c35536bc36_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
4916	2026-09-10_a3d6be9a75d3487fbfdec5c35536bc36_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
4916	2026-09-10_a3d6be9a75d3487fbfdec5c35536bc36_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
3616	svchost_CBBCCBCAAACAACACBBBACCACABAABCBCABBABBBCACCCAAACCBAAAAA.exe
3616	svchost_CBBCCBCAAACAACACBBBACCACABAABCBCABBABBBCACCCAAACCBAAAAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	2026-09-10_a3d6be9a75d3487fbfdec5c35536bc36_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Token: SeDebugPrivilege	3616	svchost_CBBCCBCAAACAACACBBBACCACABAABCBCABBABBBCACCCAAACCBAAAAA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4304	4916	2026-09-10_a3d6be9a75d3487fbfdec5c35536bc36_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	92
PID 4304 wrote to memory of 5128	4304	cmd.exe	94
PID 4916 wrote to memory of 2324	4916	2026-09-10_a3d6be9a75d3487fbfdec5c35536bc36_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	95
PID 2324 wrote to memory of 2764	2324	cmd.exe	97
PID 4916 wrote to memory of 5748	4916	2026-09-10_a3d6be9a75d3487fbfdec5c35536bc36_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	98
PID 5748 wrote to memory of 2816	5748	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-09-10_a3d6be9a75d3487fbfdec5c35536bc36_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_a3d6be9a75d3487fbfdec5c35536bc36_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBBBCBBBBCBAABAACAAABBBABBAAABACCABCABBCBBCBABCBCBBCBCCBABAACACBCBACCBABBCBCCBABCCCCABBAACBBBABBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBCAAACAACACBBBACCACABAABCBCABBABBBCACCCAAACCBAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBBBCBBBBCBAABAACAAABBBABBAAABACCABCABBCBBCBABCBCBBCBCCBABAACACBCBACCBABBCBCCBABCCCCABBAACBBBABBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBCAAACAACACBBBACCACABAABCBCABBABBBCACCCAAACCBAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCBCBBCCCBCBCCCBBBABCBAACCCBCCCCABBCAABACACBBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBCAAACAACACBBBACCACABAABCBCABBABBBCACCCAAACCBAAAAA.exe" start= auto displayName= "UserDataSvc_CCBCBCBBCCCBCBCCCBBBABCBAACCCBCCCCABBCAABACACBBCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCBCBBCCCBCBCCCBBBABCBAACCCBCCCCABBCAABACACBBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBCAAACAACACBBBACCACABAABCBCABBABBBCACCCAAACCBAAAAA.exe" start= auto displayName= "UserDataSvc_CCBCBCBBCCCBCBCCCBBBABCBAACCCBCCCCABBCAABACACBBCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCBCBBCCCBCBCCCBBBABCBAACCCBCCCCABBCAABACACBBCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCBCBBCCCBCBCCCBBBABCBAACCCBCCCCABBCAABACACBBCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBCAAACAACACBBBACCACABAABCBCABBABBBCACCCAAACCBAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBCAAACAACACBBBACCACABAABCBCABBABBBCACCCAAACCBAAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3616

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBCAAACAACACBBBACCACABAABCBCABBABBBCACCCAAACCBAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBCAAACAACACBBBACCACABAABCBCABBABBBCACCCAAACCBAAAAA.exe
1⤵
- Executes dropped EXE
PID:3700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 14a5b49c327d08e9c7289b186bd53828b990d1dc751f46a95048988db3918534
MD5 f7b4af2255b7109db36229dfcfe84d79
SHA1 156a7809891812bbd37bd1c7fd7b55e9ec62a183
SHA512 dedda4b2b5309b8a14b2e0e1e981dda63322267c60f0fe7604c060c490746f1801acc52e729f0cf768b4c4a84b1872cbf73350f81154be43b300d1dbebfa37fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f17851142a7b2e9d6581b1842db2514ba693a99fb3cd18437bb9a536f05da981
MD5 daaea4acf12e80761225420569809c61
SHA1 28d02781967c183bd94d338798654f8514e24ef6
SHA512 b4f47d59cf8e85a273e78df789e64e51e5c05c3d180828e9e7750d5be6631a3fdb5f5cd6dcac18348d9790c9aef87d6e60a99182b8946b8e1ab291913e3d1cbb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 14d12e1f358fbd865da89ea894936ef4be9301701d058ef0d4b30f4ef3360150
MD5 d9ed82e6a25d7c5bca5b2a3c9ca8e6d4
SHA1 ef2cda8358fc1a7995fc6a574464d32a4bae36a3
SHA512 de96a3957edb56157d3839a3513f6b75d8caad6ee931418233ac2c90db4f6dc70a53063adc043fc3e9a7dd29d8f0f81190d94b48a8e070120dd22e3893a3d921
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1fc26221fec85816e8b5ee428a7c4f037e1641a4f1b205cebee9c8e4d8fb7c76
MD5 f84103c7085b5e621be10b621d0ab699
SHA1 5bb61a4708e36564d4793fe71887828021aca5cb
SHA512 e797be86d072962c8fbb7263e0d320ff1ef99c5e776947602eb33f2da59ec4da0bb69360ad1633cb4313e681fd070085b9253c0528f8bfbc830fd4d86d12a6eb
MD5 SHA1 SHA512

Submit Download

memory/3616-25-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/3616-38-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/4916-0-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/4916-8-0x0000000000730000-0x0000000000751000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads