265958cbe5d47002b530a3c63465603990be77c15ef0b8544060476609c12cfc

Analysis

max time kernel
149s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-11_17f7aafd24e5482433184d1c9faae9d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 17.5MB
Sample260912-p16thacb27
SHA256 265958cbe5d47002b530a3c63465603990be77c15ef0b8544060476609c12cfc
MD5 17f7aafd24e5482433184d1c9faae9d5
SHA1 5f17680823dca2b2381feac150d801de4abd74f7
SHA512 4cd6a676a7e4ab234be8064d5c493b05df035b2d56fd1a55a7da9833ca1051553eb0255b196968cc5ddcc20325e628949f4d168176d1b02d8241399568ffff3e
SSDEEP 49152:U+ES+E9b+E9B+ES+E9B+ES+E9B+ES+E94AoLhO0+ES+E9b+E9B+ES+E9B+ES+E97:Z22222222cOU/jIEeQfoR/IuOFVjUu5h
TLSH
T1B3073B05FAD940A5E47742704DABC27A9531BD258B12CAEFF248D36E5E33BD09D34B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3764	svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe
5608	svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe
3696	svchost_ABBBAABBAAABABBBABABCBBBACCCBAACCBABACCAABBACAAABCCBAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACCCACCBCBABBBABACBCCACBACACCABCBBAACCCABACBCAACBAAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBAABBAAABABBBABABCBBBACCCBAACCBABACCAABBACAAABCCBAAB.exe"	svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACCABCABBCAABCCAACBAABAAAABACCBABBCBCCCCCCBBBBBABBBAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe"	2026-09-11_17f7aafd24e5482433184d1c9faae9d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4888	sc.exe
3908	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3492	cmd.exe
600	cmd.exe
2588	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBAABBAAABABBBABABCBBBACCCBAACCBABACCAABBACAAABCCBAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-11_17f7aafd24e5482433184d1c9faae9d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3664	2026-09-11_17f7aafd24e5482433184d1c9faae9d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3664	2026-09-11_17f7aafd24e5482433184d1c9faae9d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3664	2026-09-11_17f7aafd24e5482433184d1c9faae9d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3664	2026-09-11_17f7aafd24e5482433184d1c9faae9d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3764	svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe
3764	svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe
3764	svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe
3764	svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3664	2026-09-11_17f7aafd24e5482433184d1c9faae9d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3764	svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 3492	3664	2026-09-11_17f7aafd24e5482433184d1c9faae9d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	89
PID 3492 wrote to memory of 6092	3492	cmd.exe	91
PID 3664 wrote to memory of 600	3664	2026-09-11_17f7aafd24e5482433184d1c9faae9d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 600 wrote to memory of 4888	600	cmd.exe	94
PID 3664 wrote to memory of 2588	3664	2026-09-11_17f7aafd24e5482433184d1c9faae9d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	95
PID 2588 wrote to memory of 3908	2588	cmd.exe	97
PID 3764 wrote to memory of 2868	3764	svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-09-11_17f7aafd24e5482433184d1c9faae9d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-11_17f7aafd24e5482433184d1c9faae9d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCCBCCCAABCACABBBBBBCACCCAAACCAABACACAAABCACBACBACBCBBACBAAABCBBBAACCBBACBCBBBACABCBBCAABCBCBBCCBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCCBCCCAABCACABBBBBBCACCCAAACCAABACACAAABCACBACBACBCBBACBAAABCBBBAACCBBACBCBBBACABCBBCAABCBCBBCCBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAACCBCBCAAACCCCCCCACBCBCACAABABACBCBCCBCCCBCCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe" start= auto displayName= "UserDataSvc_CAAACCBCBCAAACCCCCCCACBCBCACAABABACBCBCCBCCCBCCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:600
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAACCBCBCAAACCCCCCCACBCBCACAABABACBCBCCBCCCBCCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe" start= auto displayName= "UserDataSvc_CAAACCBCBCAAACCCCCCCACBCBCACAABABACBCBCCBCCCBCCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAACCBCBCAAACCCCCCCACBCBCACAABABACBCBCCBCCCBCCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAACCBCBCAAACCCCCCCACBCBCACAABABACBCBCCBCCCBCCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe
1⤵
- Executes dropped EXE
PID:5608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAABBAAABABBBABABCBBBACCCBAACCBABACCAABBACAAABCCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAABBAAABABBBABABCBBBACCCBAACCBABACCAABBACAAABCCBAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 969d91242dad534b6f0bf4e929dfd314f4627b7db0aeb5905b2bfc17aa4e9729
MD5 0361e5549fb979949e4212eece6b3b14
SHA1 8bbb89c898615710aa8bc339351224b5a7ea9195
SHA512 5097966b94cf5cb95ea356b678faf87a495d8219ba1a0a2b80c09f9914d93799dcb1c442e766dd74c74fe65949fb83cdb15c64fa61df8fb8dbfe388b9f2f705e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8dc7808921e16b6ccbeafafab501fa72c129062107d32db7599ada0b7def6194
MD5 852ec5f613b902bb51ccb95114c19619
SHA1 4e200683c1994af64554844b9d50ac41e77839de
SHA512 8ca4692feb920bc9e5bcb9a0d00b63c4ec565f3f932f0d97d12d861da41ae1323835d993f02f86e2044612cc5135fb22f6b6f0658c46ab3397d454fba7a5afe2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1145f9a572d90bedd91b8e85997b87ec1a76b511a24c151aed78cdf5ff68d5cc
MD5 6a770b35e291747e98ce3a40982837d2
SHA1 1782b3de8750a6e2750a4034f19bf73b027c77b0
SHA512 9ef6ccd9cb0ce399454893cd9fde0bac55a29007a569691c90ef16913b0af8f713e616aed704f8301e7341b3efa5a49f54bb0f9cb8c7dd528c4b613ad669fcb9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9bf44dfc78085c43248f49b02112dbc9519816ac63db333bbdf3e575c5cf6d15
MD5 321843d2ed9626138bdf8d0cb64ae09a
SHA1 f7001bd413e4a33f1eeb0aaaf1853e241661d865
SHA512 5fb2780abdfd7bae81af757befc19165107a003456717976b369f90aebf42f806cea477c314b213a69133f3dfe39ad43a13093ef98a875f7dcc5871bec374a22
MD5 SHA1 SHA512

Submit Download

svchost_ABBBAABBAAABABBBABABCBBBACCCBAACCBABACCAABBACAAABCCBAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAABBAAABABBBABABCBBBACCCBAACCBABACCAABBACAAABCCBAAB.exe
Size 15.3MB
SHA256 49174d84221463ced0f32d46e5deffb0ba78d3a78e4a6ffab17345fbcf4a04ff
MD5 9bac8df2039de069d4a8ef7f220bd756
SHA1 1631085adb3af2085ae3c53178ad200823f82bda
SHA512 d3a352736be5fe7b3cd00624a600f368ad693f2e4fafa8f65a14d0cdb6d49887b8d8d60605ce1ff34e0423dbb73cfe86a74ac329481877b156b0cc4433fe85e2
SSDEEP 49152:U+ES+E9b+E9B+ES+E9B+ES+E9B+ES+E94AoLhO0+ES+E9b+E9B+ES+E9B+ES+E9A:Z222222221
TLSH
T1E7F63A05FADA40A5E47742704DABC2BA9531BD258B12CAEFF244D36E5D33BD09D34B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABABCACCCAACBCBCACACCBCBCCCCBCACACACCCBCAABACBBBACA.exe
Size 17.5MB
SHA256 265958cbe5d47002b530a3c63465603990be77c15ef0b8544060476609c12cfc
MD5 17f7aafd24e5482433184d1c9faae9d5
SHA1 5f17680823dca2b2381feac150d801de4abd74f7
SHA512 4cd6a676a7e4ab234be8064d5c493b05df035b2d56fd1a55a7da9833ca1051553eb0255b196968cc5ddcc20325e628949f4d168176d1b02d8241399568ffff3e
SSDEEP 49152:U+ES+E9b+E9B+ES+E9B+ES+E9B+ES+E94AoLhO0+ES+E9b+E9B+ES+E9B+ES+E97:Z22222222cOU/jIEeQfoR/IuOFVjUu5h
TLSH
T1B3073B05FAD940A5E47742704DABC27A9531BD258B12CAEFF248D36E5E33BD09D34B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3664-0-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/3664-8-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/3764-24-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/3764-37-0x0000000000240000-0x0000000000261000-memory.dmp

Download