59cd3dc1c42c8847d0dd7a028a00d7a6fe8a0d871301c78b1be1041b5b7be686

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/10/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-04_e759e6c32e8abb402fbdfdbbaa517f58_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Size 5.7MB
Sample261004-3efbbadf65
SHA256 59cd3dc1c42c8847d0dd7a028a00d7a6fe8a0d871301c78b1be1041b5b7be686
MD5 e759e6c32e8abb402fbdfdbbaa517f58
SHA1 dd4514a413ebf1d3677f391115207199cad15140
SHA512 7ba0ec7e9477f99730b3be77c47cec5eed11abddeb2c4fe18c48d6bab7c73394b3cdef1040474b2369fdda8a7366a71504d2eee69ebfec2218b59ab3067cbddd
SSDEEP 49152:U+EB+ES+ES+EE+EB+ES+ES+ETqatgluu+EB+ES+ES+EE+EB+ES+ES+ETqatgluuW:frprpryOU/jIEeQfoR/IuOFVjUu5m
TLSH
T132568D05F98244B1E57701714CDBD2BE8670BA258B228EEBF78C871F6F32AD19935712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2228	svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe
4824	svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe
3876	svchost_BCABBACAAACABBCCBCAAABACACBCACCACCBCCAAACBCBACBCACAACAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCAABCCCCABACCCCCABCACBCACBBABBAACACABBBAABBACBBCBABCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe"	2026-10-04_e759e6c32e8abb402fbdfdbbaa517f58_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCCACABCCABACCCBAACBCACCBACACCBAACABCCCACAABCBACACCCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABBACAAACABBCCBCAAABACACBCACCACCBCCAAACBCBACBCACAACAC.exe"	svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2368	sc.exe
3812	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2028	cmd.exe
4872	cmd.exe
3576	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-04_e759e6c32e8abb402fbdfdbbaa517f58_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABBACAAACABBCCBCAAABACACBCACCACCBCCAAACBCBACBCACAACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4132	2026-10-04_e759e6c32e8abb402fbdfdbbaa517f58_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
4132	2026-10-04_e759e6c32e8abb402fbdfdbbaa517f58_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
4132	2026-10-04_e759e6c32e8abb402fbdfdbbaa517f58_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
4132	2026-10-04_e759e6c32e8abb402fbdfdbbaa517f58_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
2228	svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe
2228	svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe
2228	svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe
2228	svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	2026-10-04_e759e6c32e8abb402fbdfdbbaa517f58_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Token: SeDebugPrivilege	2228	svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2380	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 2028	4132	2026-10-04_e759e6c32e8abb402fbdfdbbaa517f58_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	110
PID 2028 wrote to memory of 2052	2028	cmd.exe	112
PID 4132 wrote to memory of 4872	4132	2026-10-04_e759e6c32e8abb402fbdfdbbaa517f58_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	114
PID 4872 wrote to memory of 2368	4872	cmd.exe	116
PID 4132 wrote to memory of 3576	4132	2026-10-04_e759e6c32e8abb402fbdfdbbaa517f58_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	117
PID 3576 wrote to memory of 3812	3576	cmd.exe	119
PID 2228 wrote to memory of 3360	2228	svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe	121
PID 3360 wrote to memory of 4088	3360	notepad.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-10-04_e759e6c32e8abb402fbdfdbbaa517f58_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-04_e759e6c32e8abb402fbdfdbbaa517f58_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBAACAACABABABACCBACBCAABACACCCBCCBCBABAACBBAABBAABAACAAACABBABBCAACCABCBABCCCAACAAAACBBABCBACBBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBAACAACABABABACCBACBCAABACACCCBCCBCBABAACBBAABBAABAACAAACABBABBCAACCABCBABCCCAACAAAACBBABCBACBBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBABBBBBBCCBCBBCCCABACABBBCCBBBBBCCCCCABCABACCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe" start= auto displayName= "UserDataSvc_CCCBABBBBBBCCBCBBCCCABACABBBCCBBBBBCCCCCABCABACCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBABBBBBBCCBCBBCCCABACABBBCCBBBBBCCCCCABCABACCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe" start= auto displayName= "UserDataSvc_CCCBABBBBBBCCBCBBCCCABACABBBCCBBBBBCCCCCABCABACCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBABBBBBBCCBCBBCCCABACABBBCCBBBBBCCCCCABCABACCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBABBBBBBCCBCBBCCCABACABBBCCBBBBBCCCCCABCABACCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe
1⤵
- Executes dropped EXE
PID:4824

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2380

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBACAAACABBCCBCAAABACACBCACCACCBCCAAACBCBACBCACAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBACAAACABBCCBCAAABACACBCACCACCBCCAAACBCBACBCACAACAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eec771caee80a116ac058e78237ee017529c59fa015f2f5cdc8b6dd48ba56ef8
MD5 06fc9b2f3e927d82eaf5cafb74d73532
SHA1 8caa12e73afe79903ebe85c5c9f5e4b1609196f2
SHA512 daf771ecdc50a89a22a8131a83c4ef49fb8d265fc8d25a46c962fff02b1ddb7e5416b1565f07f4e6135082210d3d3a1a85448a0b50caedc6c585391a2e62b7b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f767d55aaa96bf76c87be9ce61f6f7d4f0e5a2f683c281c2ac238c85eb45f71a
MD5 5695b7fd94e4277561b6a399b13cf21c
SHA1 ff99a0022c06daecff312ac46d7de5ccbb06c832
SHA512 91f707db12935c69106a8ff333a14a3d3b5c638df187f79e6df40136778f39183069d784e777e44075d518a03f5a5171494903ef1280fe0ab053505ff604499c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b36135645513bb2eaa83ec427b026d4d1a60aa85ef975116842abe157e65bfca
MD5 8ad7c2a49433c2ca8c9efbb0eab52b3b
SHA1 e19275a4a829516ef31929607b4f798a66da4d78
SHA512 888623268132c4de2f6ad6daf31083493a80e6f0b1a84f6a7d79d400858401830dc9fa5f58724838aab3b70505df98322fad77a68200ad67cd0674047665de6f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 de3d15110798e757bf979810f2c07ce08e713000faa27ec9cd1420320e3792ed
MD5 9638ea8b10e77f6d6c02cdb4acaa6406
SHA1 e2d592638c424c82ac190bca90d813a0a156ec35
SHA512 e0348e910816ba9f8fd5a7f3c6869b9a97b2e85b3610a65c488d62ca53cf40367ab63d155371f1d9401853909366a40336d1db9ee7ffeeaf9763a5112605483e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d57fb85265c4d86bb102169aeb7a47e96f745c3cccb14402a665dd37d5bd28dc
MD5 b7e490315fe30266ad5a25bd3f66b717
SHA1 81d177e92e96ee000a3b0c793a20bada529a6dbc
SHA512 10ff473a991a46694fdf772e5e5487bb1d0b73a2b9294fa6714970322ebe4b3f0fd6ecef11d0bc4b7e79e2df9ba434affc68576c6fd3867fea0f3ca84c174c02
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ca3c195c93fce95e509666cca38f7c6d7b1093d0502aeb69f5632ceb93c52c38
MD5 85c50c8493854b146989728914aec03b
SHA1 ed5e1593160214001fa5d629f621d7b8698b7513
SHA512 d3be581e11f039c1cf76ed268775a71d5be62e8cb47cd99c699d2f434985004ce4623c971ea47614a5f3daacf6e0a5e35633f591984ff534929fd656ef460030
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7508b645a0383c2a62b72f6b749352eaeaed5c85edeaf2ae78e8bcea6c44c427
MD5 217a85bfa54aeb57c2d3df8caf1a595d
SHA1 28f938061d7c0d97f55d4cad1cce8501dc7ba237
SHA512 b895474f2f429051dc6ed7229fcd3e011b8e831105551356854c87139f490fa3e25db9cff6a9c98c63a5cba369b180dc6c73987eae14f973a38fc68b8b780056
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7837ca86fdc4e26150fc4477ac3a9d9add28374e9dd7f489d5f21167adc5d363
MD5 5d2ef253b5abb6f3388082dd0b81d284
SHA1 2150e35605050b0e266b55238a469a5542a8423b
SHA512 c5ab503250456e89baff25fcb48ea35e56f947464955ca5b61370ca8cc4866da7ddbf88e45f0f06903984e5d38bd3ad6c0e583988eca0c0c39d8fbc5c40cb0e5
MD5 SHA1 SHA512

Submit Download

svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCBBCAABCBABACBCBACABCBACAABAACABACACBCABBACABABCAA.exe
Size 5.7MB
SHA256 59cd3dc1c42c8847d0dd7a028a00d7a6fe8a0d871301c78b1be1041b5b7be686
MD5 e759e6c32e8abb402fbdfdbbaa517f58
SHA1 dd4514a413ebf1d3677f391115207199cad15140
SHA512 7ba0ec7e9477f99730b3be77c47cec5eed11abddeb2c4fe18c48d6bab7c73394b3cdef1040474b2369fdda8a7366a71504d2eee69ebfec2218b59ab3067cbddd
SSDEEP 49152:U+EB+ES+ES+EE+EB+ES+ES+ETqatgluu+EB+ES+ES+EE+EB+ES+ES+ETqatgluuW:frprpryOU/jIEeQfoR/IuOFVjUu5m
TLSH
T132568D05F98244B1E57701714CDBD2BE8670BA258B228EEBF78C871F6F32AD19935712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2228-38-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/2228-25-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/3360-67-0x00000000053A0000-0x00000000053A1000-memory.dmp

Download

memory/3876-80-0x0000000000130000-0x0000000000151000-memory.dmp

Download

memory/4132-6-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/4824-74-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download