Overview

overview

10

Static

static

10

2026-07-06...a-.exe

windows10-2004-x64

7

2026-07-06...a-.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 20:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_b9336d97f6653c0b9faec4b1aacf373f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
  • Size 14.4MB
  • Sample260706-yzs1pac19z
  • SHA256 d8a497ac0772b5f659164f2f6470efc17967403c849c57c2a441db3c3cbe9fbc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_b9336d97f6653c0b9faec4b1aacf373f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_b9336d97f6653c0b9faec4b1aacf373f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3268
    • \??\c:\users\admin\appdata\local\temp\2026-07-06_b9336d97f6653c0b9faec4b1aacf373f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      c:\users\admin\appdata\local\temp\2026-07-06_b9336d97f6653c0b9faec4b1aacf373f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=107.294.200 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x7ff622435960,0x7ff622435970,0x7ff622435980
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4820
    • \??\c:\users\admin\appdata\local\temp\2026-07-06_b9336d97f6653c0b9faec4b1aacf373f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-07-06_b9336d97f6653c0b9faec4b1aacf373f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_3268_TFSSDCSQUHOFTEXT" --sandboxed-process-id=2 --init-done-notifier=808 --sandbox-mojo-pipe-token=11532438779173541098 --mojo-platform-channel-handle=784 --engine=2
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:3560

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        edls_64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\edls_64.dll
        • Size 449KB
        • SHA256 0ce49dc9f71360bf9dd21b8e3af4641834f85eed7d80a7de0940508437e68970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        em000_64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\em000_64.dll
        • Size 37KB
        • SHA256 8b0613b91229c98dfa5398568a4fa40dde2a2d40028654f74923bc929d6b5b30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        em001_64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\em001_64.dll
        • Size 378KB
        • SHA256 a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        em002_64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\em002_64.dll
        • Size 2.3MB
        • SHA256 bb1733b7cb012f8b7d6cd0347283a549ffeab7beb4b3d0168e0d8c9cecdef8eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        em003_64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\em003_64.dll
        • Size 1.3MB
        • SHA256 ebfeeac7733a77a1e32995d638d67d2e05eefdbb62782053d8354959e046d0fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat
        • Path \??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
        • Size 40B
        • SHA256 943f6721d24748851b1776051c20ec2fb96b48205c55ddd3e024b78c160f0357
        • MD5 SHA1 SHA512
        Submit Download

        memory/3560-3-0x00007FFF2D160000-0x00007FFF2D161000-memory.dmp
        Download

        memory/3560-4-0x00007FFF2D340000-0x00007FFF2D341000-memory.dmp
        Download