126fe97909d38a8970c15f3b9bbd9ce1cf2143860a6ac9535286e48797e63fc2

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_fa22d692b9d2d8b5538af1829a9e997c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 22.9MB
Sample260807-aayymsch99
SHA256 126fe97909d38a8970c15f3b9bbd9ce1cf2143860a6ac9535286e48797e63fc2
MD5 fa22d692b9d2d8b5538af1829a9e997c
SHA1 bfa838eaa2b2687b8c1e3ac54a9122d49851fe1c
SHA512 87d17f1d44ba717053a73d9552caa08adeba1c4870c140b3107c2292f85566dba6fae4cd5ff0622863a9fc5d2433e2786e514f1c0df6cd26dd58f5c521d1d0fb
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou51tIDewjqkjiqMQ:iZahvQHrc8u3xXJ/f4uUWHe8KwekyQ
TLSH
T12E379E26B7A581E5D46AD1B899578232E7767C40073263CB56E1F61A2F33BE14F3A330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c529-19.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c529-19.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c529-19.dat	INDICATOR_EXE_Packed_Yano

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c529-19.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4876	svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe
3900	svchost_BBACBACCBCAACAABBCBBBCBACBACBCCABBCABACCBCCABBABCCCACBB.exe
3724	svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACCBBBBABAACCBACBCAACBAACACBABBCBAAAAACABCBCCBBBACBAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe"	2026-08-06_fa22d692b9d2d8b5538af1829a9e997c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBAACBCBCBBCCACCBABBCCCBCCCAABBAABBBBCCAAACACCABBACCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACBACCBCAACAABBCBBBCBACBACBCCABBCABACCBCCABBABCCCACBB.exe"	svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4316	sc.exe
5072	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5864	cmd.exe
4312	cmd.exe
4108	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACBACCBCAACAABBCBBBCBACBACBCCABBCABACCBCCABBABCCCACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_fa22d692b9d2d8b5538af1829a9e997c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2924	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5404	2026-08-06_fa22d692b9d2d8b5538af1829a9e997c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5404	2026-08-06_fa22d692b9d2d8b5538af1829a9e997c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5404	2026-08-06_fa22d692b9d2d8b5538af1829a9e997c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5404	2026-08-06_fa22d692b9d2d8b5538af1829a9e997c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4876	svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe
4876	svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe
4876	svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe
4876	svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5404	2026-08-06_fa22d692b9d2d8b5538af1829a9e997c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	4876	svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5404 wrote to memory of 5864	5404	2026-08-06_fa22d692b9d2d8b5538af1829a9e997c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 5864 wrote to memory of 2924	5864	cmd.exe	94
PID 4876 wrote to memory of 2860	4876	svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe	95
PID 5404 wrote to memory of 4312	5404	2026-08-06_fa22d692b9d2d8b5538af1829a9e997c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 4312 wrote to memory of 4316	4312	cmd.exe	100
PID 5404 wrote to memory of 4108	5404	2026-08-06_fa22d692b9d2d8b5538af1829a9e997c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	101
PID 4108 wrote to memory of 5072	4108	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-06_fa22d692b9d2d8b5538af1829a9e997c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_fa22d692b9d2d8b5538af1829a9e997c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCCACCBBCCACABBBACCACBCACBCCBBCAACAACBAACACACBCCCCCBCAABACACBAAACCABBBCCABCCBBBABCABABABABCAABBACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCCACCBBCCACABBBACCACBCACBCCBBCAACAACBAACACACBCCCCCBCAABACACBAAACCABBBCCABCCBBBABCABABABABCAABBACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACABCACBABBBAAABACBACBCAACACBCBBBCAAAAAACBBBBAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe" start= auto displayName= "UserDataSvc_ABACABCACBABBBAAABACBACBCAACACBCBBBCAAAAAACBBBBAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACABCACBABBBAAABACBACBCAACACBCBBBCAAAAAACBBBBAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe" start= auto displayName= "UserDataSvc_ABACABCACBABBBAAABACBACBCAACACBCBBBCAAAAAACBBBBAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACABCACBABBBAAABACBACBCAACACBCBBBCAAAAAACBBBBAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACABCACBABBBAAABACBACBCAACACBCBBBCAAAAAACBBBBAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5072

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2860

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBACCBCAACAABBCBBBCBACBACBCCABBCABACCBCCABBABCCCACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBACCBCAACAABBCBBBCBACBACBCCABBCABACCBCCABBABCCCACBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe
1⤵
- Executes dropped EXE
PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4f7c60c3a34e25c5605a0b1c5f9fbd81d05c64f2a1016a4f60294e6791abbf60
MD5 2cbca8dc3497020d255acbb8a75100c2
SHA1 a081591aa5f18c57f666d46a864d90b3f14996b2
SHA512 54b0638b3b655a94a35ad5750c97ede4713ac06343b8a6cc35475755c0744d7e116cbe95a35610b9fecd820d79314985d8afb39441975831fcbb9b0be8ebddec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d8cf26172623b8eb1eaa7fa07e8676153aeca77cb405d68513561d531f1094ac
MD5 8e483e0c2bd8fa95731c89c8831b6d28
SHA1 276b19b716ad27920c4e2dd2509e73b08eaf403a
SHA512 e9886d76181ad251d00253834b7df9c0b63bea67ec763d4e81070bb91672007a82833c1b180984ea1477b25e77ee2382ac8a7e780b2f6ceb4697478144d77935
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0e6967680d3f8de8e32b0cd93637b6040ebe772078b6d0fa26357c66f0eaa4cf
MD5 72cae79a4e05ab70bd999082dfaf74c9
SHA1 b57b8e87bc93e4fa9d8c418998123ac5e34fe1b4
SHA512 f31c46222c4e26dfe4a37321afcdc6d003446b7a8991c8642e737217ff52b647471688864fed010ad27983d06214e52f947236568c58f225cbb6717d2689882f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3476d02a6aadb74d3783ee3e82a676190ca2f274e25f6626d0dd64a475b8c8c0
MD5 9dbf93d7d2986b09b7561eff458e4b09
SHA1 27d8d892b223f91ac5689d024168206314376234
SHA512 9f9d2a528131e9fc34f04e0cbd2c81ba34b1063d1f79d434eb256e70e4edd85aa6c38a321fc96c3b0837b7b84c295e89db50b3cc98374b8cc7b9e6bd2ab6227b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2813a7e98d20d7d3378e20a5574eec0f86b98d9c06540cd58a32186b4b100beb
MD5 b37368c1b050b260f990606b3866fbcd
SHA1 79b378d57cc2e2ecf272e68c0c11634763a01984
SHA512 2b9cb18039a1dcda21c83d757640fea94498b3696f565e320eab40172afa650ff56eb5e061e5864caa8b7297bac02c532d184d9aa09f386e7ded49492e486a50
MD5 SHA1 SHA512

Submit Download

svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCAACACABACACCBCCBACBBBABAACABCBCBCACBCAABCAACCCBB.exe
Size 22.9MB
SHA256 126fe97909d38a8970c15f3b9bbd9ce1cf2143860a6ac9535286e48797e63fc2
MD5 fa22d692b9d2d8b5538af1829a9e997c
SHA1 bfa838eaa2b2687b8c1e3ac54a9122d49851fe1c
SHA512 87d17f1d44ba717053a73d9552caa08adeba1c4870c140b3107c2292f85566dba6fae4cd5ff0622863a9fc5d2433e2786e514f1c0df6cd26dd58f5c521d1d0fb
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou51tIDewjqkjiqMQ:iZahvQHrc8u3xXJ/f4uUWHe8KwekyQ
TLSH
T12E379E26B7A581E5D46AD1B899578232E7767C40073263CB56E1F61A2F33BE14F3A330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3724-71-0x0000000000930000-0x0000000000951000-memory.dmp

Download

memory/3900-70-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/4876-23-0x0000000000930000-0x0000000000951000-memory.dmp

Download

memory/4876-33-0x0000000000930000-0x0000000000951000-memory.dmp

Download

memory/5404-0-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/5404-7-0x0000000000740000-0x0000000000761000-memory.dmp

Download