Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
10/02/2026, 12:26
General
- Target 2026-02-10_0040df58dec2a37687a885bf1a2ac099_amadey_cobalt-strike_elex_eternity-stealer_glassworm_luc.exe
- Size 821KB
- Sample260210-pl8dsads7d
- SHA256 99dacfaffe443309956d4ffa10b58e5c87de6c73339473712d9ade2cda57c923
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detects Eternity stealer 1 IoCs
- Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
- Eternity family
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
- Disables Task Manager via registry modification
- Executes dropped EXE 1 IoCs
- Windows security modification 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-02-10_0040df58dec2a37687a885bf1a2ac099_amadey_cobalt-strike_elex_eternity-stealer_glassworm_luc.exe"C:\Users\Admin\AppData\Local\Temp\2026-02-10_0040df58dec2a37687a885bf1a2ac099_amadey_cobalt-strike_elex_eternity-stealer_glassworm_luc.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dcd.exe"C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_iq1v0quf.vha.ps1
dcd.exe
memory/3136-13-0x00000208891C0000-0x00000208891D0000-memory.dmp
memory/3136-25-0x0000020889050000-0x000002088905C000-memory.dmp
memory/3136-15-0x0000020889190000-0x00000208891B2000-memory.dmp
memory/3136-14-0x00000208891C0000-0x00000208891D0000-memory.dmp
memory/5700-2-0x0000000001540000-0x0000000001541000-memory.dmp
memory/5700-11-0x000000001B950000-0x000000001B960000-memory.dmp
memory/5700-10-0x0000000001550000-0x000000000155C000-memory.dmp
memory/5700-9-0x0000000001540000-0x0000000001541000-memory.dmp
memory/5700-1-0x0000000001540000-0x0000000001541000-memory.dmp
memory/5700-0-0x0000000000CD0000-0x0000000000DA6000-memory.dmp
memory/5700-3-0x000000001B950000-0x000000001B960000-memory.dmp
memory/5700-4-0x0000000001560000-0x000000000159E000-memory.dmp