e569ef7cf056327f9c095e565ecf3c582a9e03f23439840f0202c7fc42dcc317

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_0dfca70d66a615dcbb67f7695cdd92e5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 16.6MB
Sample260808-ccc53afp6z
SHA256 e569ef7cf056327f9c095e565ecf3c582a9e03f23439840f0202c7fc42dcc317
MD5 0dfca70d66a615dcbb67f7695cdd92e5
SHA1 4a52a8894d46f8c79be3dc88c0563ea435024201
SHA512 2e74c3d9e0ad1fc408235850ccbb8882a812abe41b457568d578856743fddaf386ac4ab595150fec434f7253d89476e5bb3728a9e92dc227649fcf43f4932cfa
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou0:iZahvQHrc8u3xXJ/f4uUWHZ
TLSH
T14807AE17B35A81E6C42AE2B88A474223D7B67C440330A7DB16D5B7692F37BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4a9-19.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4a9-19.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4a9-19.dat	INDICATOR_EXE_Packed_Yano

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4a9-19.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1856	svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe
4224	svchost_BCCBCBAABBBCABCCCCCBCAAABACAAAACAACCCCCCACCBCBBBCBACCCA.exe
5508	svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBAAABBBCBCCBBABCBAAABCBBCBCCCCABCABBABCCABACBBCCBAAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe"	2026-08-07_0dfca70d66a615dcbb67f7695cdd92e5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACACACAACBABABBBACAABAAACBBCBBCAAACBBCBBBACACAACCCCBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBCBAABBBCABCCCCCBCAAABACAAAACAACCCCCCACCBCBBBCBACCCA.exe"	svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6040	sc.exe
1572	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
120	cmd.exe
432	cmd.exe
1708	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_0dfca70d66a615dcbb67f7695cdd92e5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBCBAABBBCABCCCCCBCAAABACAAAACAACCCCCCACCBCBBBCBACCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2508	2026-08-07_0dfca70d66a615dcbb67f7695cdd92e5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2508	2026-08-07_0dfca70d66a615dcbb67f7695cdd92e5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2508	2026-08-07_0dfca70d66a615dcbb67f7695cdd92e5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2508	2026-08-07_0dfca70d66a615dcbb67f7695cdd92e5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1856	svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe
1856	svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe
1856	svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe
1856	svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe
4224	svchost_BCCBCBAABBBCABCCCCCBCAAABACAAAACAACCCCCCACCBCBBBCBACCCA.exe
4224	svchost_BCCBCBAABBBCABCCCCCBCAAABACAAAACAACCCCCCACCBCBBBCBACCCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	2026-08-07_0dfca70d66a615dcbb67f7695cdd92e5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	1856	svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe
Token: SeDebugPrivilege	4224	svchost_BCCBCBAABBBCABCCCCCBCAAABACAAAACAACCCCCCACCBCBBBCBACCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 120	2508	2026-08-07_0dfca70d66a615dcbb67f7695cdd92e5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	91
PID 120 wrote to memory of 3052	120	cmd.exe	93
PID 1856 wrote to memory of 2496	1856	svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe	94
PID 2508 wrote to memory of 432	2508	2026-08-07_0dfca70d66a615dcbb67f7695cdd92e5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	97
PID 432 wrote to memory of 1572	432	cmd.exe	99
PID 2508 wrote to memory of 1708	2508	2026-08-07_0dfca70d66a615dcbb67f7695cdd92e5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	100
PID 1708 wrote to memory of 6040	1708	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-07_0dfca70d66a615dcbb67f7695cdd92e5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_0dfca70d66a615dcbb67f7695cdd92e5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACCBBBCAABCBCCCCAAACABACCCBCCCCAABCBAAAAABCBBBBBCCAABABACBABCCBBAAABBBCBBACABBCBAABACCACCABACCBCCCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACCBBBCAABCBCCCCAAACABACCCBCCCCAABCBAAAAABCBBBBBCCAABABACBABCCBBAAABBBCBBACABBCBAABACCACCABACCBCCCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBBBBCABCCAABABCABCBCACCBCCCACACBABACBAABCCBCCBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe" start= auto displayName= "UserDataSvc_BBCBBBBCABCCAABABCABCBCACCBCCCACACBABACBAABCCBCCBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCBBBBCABCCAABABCABCBCACCBCCCACACBABACBAABCCBCCBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe" start= auto displayName= "UserDataSvc_BBCBBBBCABCCAABABCABCBCACCBCCCACACBABACBAABCCBCCBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCBBBBCABCCAABABCABCBCACCBCCCACACBABACBAABCCBCCBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCBBBBCABCCAABABCABCBCACCBCCCACACBABACBAABCCBCCBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2496

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBAABBBCABCCCCCBCAAABACAAAACAACCCCCCACCBCBBBCBACCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBAABBBCABCCCCCBCAAABACAAAACAACCCCCCACCBCBBBCBACCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe
1⤵
- Executes dropped EXE
PID:5508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3a64a91816dcfc52f45a2c4fc0044dd47e5547cbce6a8e98c871a533a52c6a16
MD5 2aabbc1cd5fb112b74c224c7d3709e54
SHA1 0c59032a2d519f4f15d082d5c3360bf06eab0db0
SHA512 ea31e5d2ee1f75878086810d046d390062428138b933f890bad7f0905a1418938277240c7452a26ca4a7257d11973058996b41e9682f171f6b83bf126d1497d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dfdb506fdb74a4d25e2300a0ce35116bb019077b3c336d58aa91dae0c3437c41
MD5 73d5de70a4d650a9a5047cddf162cd5d
SHA1 15d0ebc056688de2e4b085b7068d20993b991e66
SHA512 fa346a63e8c1a719138ea7f2b5a9bfc171ffc0cfd6d6e555247462002b875533efa4b8c041a0c010b05a6a21a9e602f4641dd133958b643f89ae704e3090fe75
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 364cb430a344b691c79bd52a854a3dbd986c392b3724f59d3216c7b26fc77af1
MD5 202ce590e5ad985e7cadb99f47d2f1ef
SHA1 472db96e3fa79b14fd7174ff819792981538dd7e
SHA512 62ceacd17658e42a79bc193510c1d547f276fc66e6d0fbbc8e58f535c49becbaaed937aad01e7679e1e8fae72c0096e69aae7fb628b30926a3e35d3995c6c09e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f7cc3d4ef1b74743abb20ed1ae0de97aa175ccf154692df7f1694b40fdccf98e
MD5 754aef0451a6fde28abfb66687f03f7c
SHA1 c7cab2705e57a2da890f92e95a3ed9baf1ce06ab
SHA512 3b072747267ecdfc7445391bd5ba07cbe079d9d55be5e0182eabc0c56f3db453063fcc2f81bf93e841b5abadfb4127687f4c59337fff97407dc5ff21334899f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c9bb739f1e7769d5afbe4a68fe68f2c124b69759fe494c9c6cf14e3e66ac9056
MD5 ddfacc10e7f121b779d79ced45517733
SHA1 4082a8ddcc3d5f8615786e3523f71531b8e1c096
SHA512 3718a03bc8004d75ecc4e3a13783dc7bcab99bb8eaab80e1609c2183c4d4a02e9896278bbcd61d38655746726ff6f0f6083d7b95e4698a1d493621da0edd5c99
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f15a6caa98bb397e057087b4e17c0a0e159bb12754256118b83fcfdfb24d7a3c
MD5 317d6edd30adfd60b8bbe1db455ffd7d
SHA1 bbbfb77bbf299b2db643c54df9655c17ee98212f
SHA512 587b88356caa3f5d047f41eaf1c827e6365bae117406acf1bf035d6d3f50bf8836205d1f17e5e25f9a6ef8bfd53bc5f8f05605eb470ef4591d23b3a09dc3cb3d
MD5 SHA1 SHA512

Submit Download

svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABBABACCBABCBCBBCCABBBCCBACCBBBACCBBBBAAABBACCCAACB.exe
Size 16.6MB
SHA256 e569ef7cf056327f9c095e565ecf3c582a9e03f23439840f0202c7fc42dcc317
MD5 0dfca70d66a615dcbb67f7695cdd92e5
SHA1 4a52a8894d46f8c79be3dc88c0563ea435024201
SHA512 2e74c3d9e0ad1fc408235850ccbb8882a812abe41b457568d578856743fddaf386ac4ab595150fec434f7253d89476e5bb3728a9e92dc227649fcf43f4932cfa
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou0:iZahvQHrc8u3xXJ/f4uUWHZ
TLSH
T14807AE17B35A81E6C42AE2B88A474223D7B67C440330A7DB16D5B7692F37BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 bfdc44755379882953d6a7da2edff8251270a178e9a001c070cdbec09f7e68bf
MD5 20b594388a945ee743920e6afb8f52fa
SHA1 017128bebdaacf720e062a904d18db74f60b7e14
SHA512 f47a3638848220d731d6aceb651d109e37466a1f125c943d6dab473bc8d177b6e9823f21baa2abcc72bb42857966c377c38ed32f4ed1efc32ac82e2cf41d5750
TLSH
T16711A790F0E9A867E53368DE861DC9C6CCD4375B6C546A56934C421867D98318D19CD2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1856-24-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/1856-34-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/2508-7-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/2508-0-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/4224-70-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download