c347895d0745fe44189d78ce2e8a95c999cfe8de7b03f0e8b8121119c785891c

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Size 9.3MB
Sample260930-be46wsvgme
SHA256 c347895d0745fe44189d78ce2e8a95c999cfe8de7b03f0e8b8121119c785891c
MD5 531734214c6a687f8347f5c9d8c7eca3
SHA1 23b9bd4b4ec3ffa9b37b8ea6f9e463cedda54d3d
SHA512 2466371ca768255fac88fce0aea9f7f8f68cf1a70096430793820f9bb7a32d8d493cd306c028d306536e2669528de266eb115d4c8d9a6e0c03d4678febdd8e95
SSDEEP 98304:JrprprprprprpryOU/jIEeQfoR/IuOFVjUu5m:tNNNNNNyFIF0wuQ
TLSH
T17BA67C05F98244B1D97701714CDBD2BE8670BA218B228EEBF78D871F6B33B919939711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4312	svchost_CACCBACCCBCCBCCCBCBCAACABBCBCBCABAACBBCACBBCCAACAABAAAA.exe
2836	svchost_AABCCBCABABABCCAAAAACACCCBACBBACBCBBBAAABBABCACACBCAABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAACABCBBBAABACAACBCACAABBAACAAAACCCACCBABBAAACABBCBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCBACCCBCCBCCCBCBCAACABBCBCBCABAACBBCACBBCCAACAABAAAA.exe"	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABACCBCCBABBCBBCBABCBBCACBBAACBCCCABABACACABBABBABAABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCCBCABABABCCAAAAACACCCBACBBACBCBBBAAABBABCACACBCAABA.exe"	svchost_CACCBACCCBCCBCCCBCBCAACABBCBCBCABAACBBCACBBCCAACAABAAAA.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4488	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCCBCABABABCCAAAAACACCCBACBBACBCBBBAAABBABCACACBCAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCBACCCBCCBCCCBCBCAACABBCBCBCABAACBBCACBBCCAACAABAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3552	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
3552	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
3552	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
3552	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
4312	svchost_CACCBACCCBCCBCCCBCBCAACABBCBCBCABAACBBCACBBCCAACAABAAAA.exe
4312	svchost_CACCBACCCBCCBCCCBCBCAACABBCBCBCABAACBBCACBBCCAACAABAAAA.exe
4312	svchost_CACCBACCCBCCBCCCBCBCAACABBCBCBCABAACBBCACBBCCAACAABAAAA.exe
4312	svchost_CACCBACCCBCCBCCCBCBCAACABBCBCBCABAACBBCACBBCCAACAABAAAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3552	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Token: SeDebugPrivilege	4312	svchost_CACCBACCCBCCBCCCBCBCAACABBCBCBCABAACBBCACBBCCAACAABAAAA.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 4488	3552	2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	94
PID 4488 wrote to memory of 3532	4488	cmd.exe	96
PID 4312 wrote to memory of 3660	4312	svchost_CACCBACCCBCCBCCCBCBCAACABBCBCBCABAACBBCACBBCCAACAABAAAA.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_531734214c6a687f8347f5c9d8c7eca3_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBAAAABAACABCCBABCCCCCCCABAAACCCBAACBACABBBCBBBABBBAAAACBBAAAACCABACCCBAACBCABBCCABBCBBCCABBCBCAABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBACCCBCCBCCCBCBCAACABBCBCBCABAACBBCACBBCCAACAABAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBAAAABAACABCCBABCCCCCCCABAAACCCBAACBACABBBCBBBABBBAAAACBBAAAACCABACCCBAACBCABBCCABBCBBCCABBCBCAABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBACCCBCCBCCCBCBCAACABBCBCBCABAACBBCACBBCCAACAABAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBACCCBCCBCCCBCBCAACABBCBCBCABAACBBCACBBCCAACAABAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBACCCBCCBCCCBCBCAACABBCBCBCABAACBBCACBBCCAACAABAAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBCABABABCCAAAAACACCCBACBBACBCBBBAAABBABCACACBCAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBCABABABCCAAAAACACCCBACBBACBCBBBAAABBABCACACBCAABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RepairInitialize.exe

Path C:\Users\Admin\Desktop\RepairInitialize.exe
Size 384KB
SHA256 fb4197ea723f61bc842a815213700091be548c1488fc7338089fc6435e220b39
MD5 be4a8e4f5f9c44972f263874d7ddd0f8
SHA1 61340a89977810caaeba2bf44c2032d8cbfeee62
SHA512 43bc8560a63d3c2296667339e27a51d9fb1a9badfc3ea1bcabfadf4ac9802779106c3cc933dcf1e1140da262c647d88ccc1da38d9e688f5eacc42162e1d54ab5
SSDEEP 6144:m+dTTUFgEs3XojAdP+dTTUFgEs3XojAdtofOiYlrOF7ojDuUlMtq10Q8m7NNqM9p:mgUFgEsnojA9gUFgEsnojAn+BeDuUlEE
TLSH
T14D845C85F98180B1D96701714D8BC2FB9670BE118F128BEBF659E32F2B337D0A236655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairInitialize.exe

Path C:\Users\Admin\Desktop\RepairInitialize.exe
Size 192KB
SHA256 40ddb94daa314ead417824d248cb39912444cac28cd4299c3167aa92d08c8213
MD5 abae38e88b8821e227fde183f494c560
SHA1 d4622b2cbdc4af7af19be3055a01fbca24b45364
SHA512 e074de8608fe9cfd3d38f40c95e0f4d530bcc2ceeb68a998934d682935bccc7830262136f48b3de0bd86b0848c2c87b5f108844d4728e8b9dd06e7875bef5e91
SSDEEP 3072:PdtpUtI9vTTLoFpmEY13XojAdoNdtpUtI9vTTLoFpmEY13XojAdoEqlfOiYl5uQW:m+dTTUFgEs3XojAdP+dTTUFgEs3XojAu
TLSH
T1B1143A09FD4710B1D92B51B049CBD3BF8620BB2583124EFFEA4DCB6B6A23BE16438555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairInitialize.exe

Path C:\Users\Admin\Desktop\RepairInitialize.exe
Size 56.9MB
SHA256 ebaab2f72d70a3c1e5caf5053b770a97bf4aab4cf3f42c85c0d048d2d91b9aa8
MD5 be694fcab09ec2f4f182438db1984ef0
SHA1 09baa056a68d350164d420de344e8fb359906b0e
SHA512 7a1435961d3543e2584e81ff57aea9deb0606f0c2070bb2d0f035f2a7dae6226d05e8265e578a57df4b2c5a3e1d3e4f83724a40d76b2e8334c2619688e1e79f3
SSDEEP 196608:tNNNNNNyFIF0wuENNNNNNyFIF0wuENNNNNNyFIF0wuENNNNNNyFIF0wuENNNNNNr:277777qHT
TLSH
T153D77C05F98244B1D97701714CDBD2BE8670BA218B228EEBF78D871F6B33B919939711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a318e106c498c4f5c2ad5de47ee693de47f41f1f4648653db63e152127c70a21
MD5 e452dd99113f8127a86f003da096c50d
SHA1 0c07876590e0fda57c738c4ad7a687d3fe926b3c
SHA512 bff516696a278877f0baab2050aea1667d0caa7c3ec18d06c078fdadd12b2db731dce4bd52f179b38685553ccd3155bc6d4953a30ab71145f19c5f2148d6d81e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9b35d5a1923fed6a3cb7a16b1041799c3c75d9aa416dde3fbde3356ada53da32
MD5 cfc17771aa6203dc3ffb447fb518aa27
SHA1 fa22727a8247c9544a1273ee19b6e8deff18caf1
SHA512 2b06958aa093210b539017619537f82ed531cd67afa15f07758d608a2fa33722bec99cc1096d1850f672b02845b155fa66c868d27966cd6b385ece8818f4d86c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5e2713d7236915c1df7065b49d36dd025c0d42d33a32091c107a3352d3cebc55
MD5 0d408e684bb062213217b1370f491424
SHA1 25090e6ff1351df377b2aa45f9950ffa54300705
SHA512 89346bdc0545d20de6b0112ec17dc11be1260d20ba3a77a8d4d81aab8b6ad5cf36a587e9faf0ddb8e1943e55abe47172ef4931a214ec488ee8700b98b529a74a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 367ef3379381d574c630f9371f2616380d881b06e4cea81830c72309b643b071
MD5 d82ff03716aa6d9455a0ac40aeded62d
SHA1 60502928692b32255f9e3bddb51c6da40bcfad2d
SHA512 40edbc4cae3e068122a75682ae7d7a61d40fdcb5c87d9f3cdbaee269264f470c5a04df4ee2226218417ff3ab72a7ff4cd7091c7511df5b55c6597bb29fadff66
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 27b206569fa0ecc018428e5703b79785f8ef09c98ec187bcc73684eca00b8a8a
MD5 4202412aea9bd0349f3b6c5629672d36
SHA1 7ae129d79f39627198078ac2e56ade1b4364f910
SHA512 5c7129b6448cfcaf7fbc0d08f5d33bafb0a1ae8622eb0bf1ec47fc63e7ba674779a76ae9dbc5f207f53cc1f92fb5e5ad42a920decf3b171f77a96be2cb6b27f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6275aa9906a11be591f680e0ff9950906d478c03336b089fb5d10f6191561823
MD5 61c2352048170302fe42726173fba36f
SHA1 c7c5a53d2598f6ed982189c7a7b004e0548bd846
SHA512 33bcd8dc48217f098d2ff512cae33597c6df85062a4871c6d200ab01bf51f5f0dd3612ef9c4ba2ab7376f13e748aff5ed47bf5207273d8c2ce48da366537822e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b8946251714e3accca062f40c58886393b2f69e647197023188cc5a561597f3f
MD5 711516ad01bc8992503b456572745d12
SHA1 1cf1b67eaab8ef5e02ab88ff242afa05540266d1
SHA512 e851d575cf74223f5f0ec78ebe6e3f384bc5edc9a1fffff382dbe5fcc47f3e01386b1a440ea119f82f1b6c13677f7e3b6c6c4a6ba95919523f44649cc1d0d864
MD5 SHA1 SHA512

Submit Download

svchost_CACCBACCCBCCBCCCBCBCAACABBCBCBCABAACBBCACBBCCAACAABAAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBACCCBCCBCCCBCBCAACABBCBCBCABAACBBCACBBCCAACAABAAAA.exe
Size 9.3MB
SHA256 c347895d0745fe44189d78ce2e8a95c999cfe8de7b03f0e8b8121119c785891c
MD5 531734214c6a687f8347f5c9d8c7eca3
SHA1 23b9bd4b4ec3ffa9b37b8ea6f9e463cedda54d3d
SHA512 2466371ca768255fac88fce0aea9f7f8f68cf1a70096430793820f9bb7a32d8d493cd306c028d306536e2669528de266eb115d4c8d9a6e0c03d4678febdd8e95
SSDEEP 98304:JrprprprprprpryOU/jIEeQfoR/IuOFVjUu5m:tNNNNNNyFIF0wuQ
TLSH
T17BA67C05F98244B1D97701714CDBD2BE8670BA218B228EEBF78D871F6B33B919939711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3552-23-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/3552-12-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/3552-48-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/3552-0-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/3552-70-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/4312-49-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download

memory/4312-71-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download