0054e4253dcb386e29b2bda1f23f78d90bace82a300512a61b5af53e1bb0e553

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-11_3bb92c735b4c1c2f4a58cc8ed4aa6f77_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 16.9MB
Sample260912-ncd8xaverd
SHA256 0054e4253dcb386e29b2bda1f23f78d90bace82a300512a61b5af53e1bb0e553
MD5 3bb92c735b4c1c2f4a58cc8ed4aa6f77
SHA1 9da283ca6b1b8e26c6f02fbb48c2ca997b9a811d
SHA512 0e69c030738dc33ae5bc7fdc8c8149750fffd43d32c372397684b7c8160bf893fd358881daf2260a807603274d948f1284962bb3f9280cebe057ee1df1b541ce
SSDEEP 98304:m5k5k5k5k5k5k5k5zOU/jIEeQfoR/IuOFVjUu5J:m5k5k5k5k5k5k5k5zFIF0wuL
TLSH
T1EA074C19F98350B1D92B51B04CCFD3BF8E607B2583124EFBFB4DCB1B6A22B916429255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3064	svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe
4288	svchost_BCBCAAACCBAAACBCCCCACCCCCBCABBACCCCBCCCBABCBAACCABBCBAC.exe
1148	svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCCBCABBAABACCCCCABCCCCCCCBACCACBABCACAACABCBABABABCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe"	2026-09-11_3bb92c735b4c1c2f4a58cc8ed4aa6f77_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCACBCBCCBBBCBBAACCBCCAAACBABCABCCBCBAACACCAABBBBAACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCAAACCBAAACBCCCCACCCCCBCABBACCCCBCCCBABCBAACCABBCBAC.exe"	svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4784	sc.exe
896	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4700	cmd.exe
856	cmd.exe
4112	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCAAACCBAAACBCCCCACCCCCBCABBACCCCBCCCBABCBAACCABBCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-11_3bb92c735b4c1c2f4a58cc8ed4aa6f77_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6140	2026-09-11_3bb92c735b4c1c2f4a58cc8ed4aa6f77_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
6140	2026-09-11_3bb92c735b4c1c2f4a58cc8ed4aa6f77_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
6140	2026-09-11_3bb92c735b4c1c2f4a58cc8ed4aa6f77_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
6140	2026-09-11_3bb92c735b4c1c2f4a58cc8ed4aa6f77_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3064	svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe
3064	svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe
3064	svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe
3064	svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe
4288	svchost_BCBCAAACCBAAACBCCCCACCCCCBCABBACCCCBCCCBABCBAACCABBCBAC.exe
4288	svchost_BCBCAAACCBAAACBCCCCACCCCCBCABBACCCCBCCCBABCBAACCABBCBAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6140	2026-09-11_3bb92c735b4c1c2f4a58cc8ed4aa6f77_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3064	svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe
Token: SeDebugPrivilege	4288	svchost_BCBCAAACCBAAACBCCCCACCCCCBCABBACCCCBCCCBABCBAACCABBCBAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6140 wrote to memory of 4700	6140	2026-09-11_3bb92c735b4c1c2f4a58cc8ed4aa6f77_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	88
PID 4700 wrote to memory of 1920	4700	cmd.exe	90
PID 3064 wrote to memory of 4644	3064	svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe	91
PID 6140 wrote to memory of 856	6140	2026-09-11_3bb92c735b4c1c2f4a58cc8ed4aa6f77_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	94
PID 856 wrote to memory of 4784	856	cmd.exe	96
PID 6140 wrote to memory of 4112	6140	2026-09-11_3bb92c735b4c1c2f4a58cc8ed4aa6f77_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	97
PID 4112 wrote to memory of 896	4112	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-09-11_3bb92c735b4c1c2f4a58cc8ed4aa6f77_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-11_3bb92c735b4c1c2f4a58cc8ed4aa6f77_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABACBABBCCAACCCABBBCAAACACBBCAABCAAACBCBBABABCBCBBACABBCABBAACBACBBBBBAABCCBBACCBACCABBCCCCBBCBBBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABACBABBCCAACCCABBBCAAACACBBCAABCAAACBCBBABABCBCBBACABBCABBAACBACBBBBBAABCCBBACCBACCABBCCCCBBCBBBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACBBBCCBBACACBACCBBBAAAAACBABAACBABBABCCBABABABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe" start= auto displayName= "UserDataSvc_CCACBBBCCBBACACBACCBBBAAAAACBABAACBABBABCCBABABABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACBBBCCBBACACBACCBBBAAAAACBABAACBABBABCCBABABABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe" start= auto displayName= "UserDataSvc_CCACBBBCCBBACACBACCBBBAAAAACBABAACBABBABCCBABABABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACBBBCCBBACACBACCBBBAAAAACBABAACBABBABCCBABABABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACBBBCCBBACACBACCBBBAAAAACBABAACBABBABCCBABABABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:896

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4644

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAAACCBAAACBCCCCACCCCCBCABBACCCCBCCCBABCBAACCABBCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAAACCBAAACBCCCCACCCCCBCABBACCCCBCCCBABCBAACCABBCBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe
1⤵
- Executes dropped EXE
PID:1148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f2d31380945bcd529e8da5a566c916bc25b9b05f2755402117a04e5aa6757817
MD5 5988ec3daa313eb3139fff0408e5c085
SHA1 eef8ba416840c24c329002fed8ce940314de9171
SHA512 6fcab4041445226fafe842a9b88916f44ed1985efb2020c8f038c68cbff1f5af216071d98a132b4883547f525fefac7f5805c2dfdf8f124717e7eb5099d3578d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 38982581517175d57b669b0051024cd92b959d0067e33c156a95ee3484869d64
MD5 1e44f68b63109be03ad3506f0560421f
SHA1 1431cd2dab6285f2690f685c3c79536bcaca614e
SHA512 efb90ffcdad9a3dd209fa5fa81e9a86ac0ddd34f15d2c1d755adb677cf6e613416685a786dc28e51ccd87bdf20c92db05bfc79c91b2d6fa4de47c7958fc53fdf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 58851d411c71741ad904081cc4046ac9f7264a19ac627cb7f6d3a33d0b6cf617
MD5 ba1f4ed8fd64bebfbca16ef71fa6939d
SHA1 01d8faf36c20119706fdc6b2e63caeef18544dd4
SHA512 90ab7f9670de0e11c07e65f90b09843a745daf1acba722fa53ba85507b6fd45061d6c438c11310815a60532378ed7749bc509685e19861b474ebf59dd90743bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7648a97841439af9fc44e2b44a39594261d6309875ee8a3747ecf90c253cf0ba
MD5 a3a9c99bd9be120e6e7411885254e9a0
SHA1 67e324639d139f9e3f4b5b20b4c1b1e95ab6be59
SHA512 4648164dbb355da6398d19744b0d3c35ef9a8f887e9b6a27d2365ae0550c76a4b384f791c21e2a9093a33e27a2a54c920b9774a459ac47debbd5e204668244b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6a51958fe450cbce107fcc6a89f0dbcaed8ae74ac47dca9ee765bbadabd823ca
MD5 846fffba34ee01ccf2554aaa4d7666c8
SHA1 53c6ca8c40ce5638c7ee5a00f65c7cb63d32719a
SHA512 ebfc2768381f26236dec5d8342cc98e28dfff1edbcf025e75ca0af06a365bb931d0d5d811b27b2a8b3ddc6b78b922899f98053a75e7439262c11820bd771e821
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 305a96f991d4e1eec5a648444864bb1cf30e5c049aace4b926ff1cb4bbe1b058
MD5 3763967d5994581cbd9fa4c9ec3be3bd
SHA1 9276e4e0f9168c7492deb0ce82e7b1531d874739
SHA512 56733e34bd67a9b0e79dbd201c23b33ec2b9be3bb03690cc930a8680f5750163d998ce5fd0c26804c3a51747e010ebe3087bdc5bead860836d2c65c8ccdef893
MD5 SHA1 SHA512

Submit Download

svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACCABAACCABCBBBCBAAAAACCBCACAAABABACAAAAACAABABBAA.exe
Size 16.9MB
SHA256 0054e4253dcb386e29b2bda1f23f78d90bace82a300512a61b5af53e1bb0e553
MD5 3bb92c735b4c1c2f4a58cc8ed4aa6f77
SHA1 9da283ca6b1b8e26c6f02fbb48c2ca997b9a811d
SHA512 0e69c030738dc33ae5bc7fdc8c8149750fffd43d32c372397684b7c8160bf893fd358881daf2260a807603274d948f1284962bb3f9280cebe057ee1df1b541ce
SSDEEP 98304:m5k5k5k5k5k5k5k5zOU/jIEeQfoR/IuOFVjUu5J:m5k5k5k5k5k5k5k5zFIF0wuL
TLSH
T1EA074C19F98350B1D92B51B04CCFD3BF8E607B2583124EFBFB4DCB1B6A22B916429255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 18f511c0152c0c7afdc5ef668c6d804ab314a0cdcfc03a4dc977f2333652d8df
MD5 db0a8a402fa670ec2148c6329cfa4b54
SHA1 8bf4ee05b3aa04bc33f26e36041bc55ce648d5e1
SHA512 849e48dd1136c917a0ea146d37b1db81ff6bb887228cb7cdd0647dd1b645d3142c90ed8b066a1a0a0a9adec4dcb6f00430d96f00d984091cb48389605c49bdd4
TLSH
T1B5113DE3F0A5E827F0756CDF92758BC64CE033DF5828AB08134E4118B725C368E194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3064-34-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/4288-74-0x0000000000640000-0x0000000000661000-memory.dmp

Download

memory/6140-0-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/6140-8-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download