c981b107eec559a05e77f309e595124203fb42d3d703a8a31a49a33bb807e7a7

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Size 18.6MB
Sample260808-dj4f9sgn2y
SHA256 c981b107eec559a05e77f309e595124203fb42d3d703a8a31a49a33bb807e7a7
MD5 9ceb6f872e8a681c26a705d6ff8e8c00
SHA1 5e8fe487611aaa5462a026e0e49cf3b246a44fb0
SHA512 4b6767f3019b2f04f5cb066654034172373b54bd07b3ec6d1140bb6c3c9629fa61677646ae2f5e6b88e278b36043147cccba57c4a2e69d79267045e88524e843
SSDEEP 196608:anSunSunSunN7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouH:a111NahvQHrc8u3xXJ/f4uUWHM
TLSH
T18117BF17F64780E5C42AE2B48A8B8337D7B57C044331ABDB6695A71A2F33BE4573A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001c674-20.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001c674-20.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001c674-20.dat	INDICATOR_EXE_Packed_Yano

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001c674-20.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3236	svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe
3492	svchost_ABAABCACACBAAACBABAACCBCAABABBCBBCBBCBCCBABCCCCBABCBBCA.exe
2564	svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCAACACBBAAAABAABBCBCAAAAAAAAABCABBCBBBCCCCAACBABACCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe"	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACACABCAACAAACABBCBBABCABBCBBABCCABBAAAACAABBABAACACBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAABCACACBAAACBABAACCBCAABABBCBBCBBCBCCBABCCCCBABCBBCA.exe"	svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1820	sc.exe
5844	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3856	cmd.exe
4264	cmd.exe
1176	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAABCACACBAAACBABAACCBCAABABBCBBCBBCBCCBABCCCCBABCBBCA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4880	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
4880	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
4880	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
4880	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
3236	svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe
3236	svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe
3236	svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe
3236	svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe
3492	svchost_ABAABCACACBAAACBABAACCBCAABABBCBBCBBCBCCBABCCCCBABCBBCA.exe
3492	svchost_ABAABCACACBAAACBABAACCBCAABABBCBBCBBCBCCBABCCCCBABCBBCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4880	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Token: SeDebugPrivilege	3236	svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe
Token: SeDebugPrivilege	3492	svchost_ABAABCACACBAAACBABAACCBCAABABBCBBCBBCBCCBABCCCCBABCBBCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 1176	4880	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe	93
PID 1176 wrote to memory of 1172	1176	cmd.exe	95
PID 3236 wrote to memory of 4760	3236	svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe	96
PID 4880 wrote to memory of 3856	4880	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe	99
PID 3856 wrote to memory of 5844	3856	cmd.exe	101
PID 4880 wrote to memory of 4264	4880	2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe	102
PID 4264 wrote to memory of 1820	4264	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_9ceb6f872e8a681c26a705d6ff8e8c00_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCCCCCACBBCABABBCBBCBCBABAAABABCCBCACCCCBBBCCCABABAACAAACCBBACCACCBBACAAAACBCACCAACABAAACACCBBAABABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCCCCCACBBCABABBCBBCBCBABAAABABCCBCACCCCBBBCCCABABAACAAACCBBACCACCBBACAAAACBCACCAACABAAACACCBBAABABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCACACCCBBAABCBBBCBABBBCACAABACBBBBBBABCBBABAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe" start= auto displayName= "UserDataSvc_BBBCACACCCBBAABCBBBCBABBBCACAABACBBBBBBABCBBABAACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCACACCCBBAABCBBBCBABBBCACAABACBBBBBBABCBBABAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe" start= auto displayName= "UserDataSvc_BBBCACACCCBBAABCBBBCBABBBCACAABACBBBBBBABCBBABAACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCACACCCBBAABCBBBCBABBBCACAABACBBBBBBABCBBABAACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCACACCCBBAABCBBBCBABBBCACAABACBBBBBBABCBBABAACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1820

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABCACACBAAACBABAACCBCAABABBCBBCBBCBCCBABCCCCBABCBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABCACACBAAACBABAACCBCAABABBCBBCBBCBCCBABCCCCBABCBBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe
1⤵
- Executes dropped EXE
PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4223845214036cbb59fc811b640e312e0f28e6d34a11f203810ed6e605b451e4
MD5 181476d6c8f0d4eb7f6be2778fa0ed9a
SHA1 ae4191538c01e6044d7b8bb69588751ab2ad8234
SHA512 0fd8c402a897b85de37294082fa872f245043cc502945b86ccc7aa43537d49360aed5a0ffcc4b731003a8b1b0fd47651b19b4f07845b1c1c679a385060d718c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3dd0d06fda4a40100b78791c6e2ae0ba76cda795e27836e92aa3bbd1387e3339
MD5 266791e87692eb793d0a7e1a00bcbb1b
SHA1 3b9b741ffc64ffb394412e08d7a2f71771045b35
SHA512 a2c240a1fa05ba53fe53602b9271e01137e53c9177a8f427007038fda2c968af04696689333c8ed80d323fdd332e99e6df222e9d136208a64ee0c4a9c275f41d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9427911c3c2791f34c174bf4c58a3ed6601957d69599a0705e81c4ab20cf8cba
MD5 cfdf3f893d00df7edd73af05216406ea
SHA1 a109e4e11a936540413166235f390ae67cbf72b3
SHA512 c0d9f30d415623d1dbaa4f00dc270a8c9f2bd772a8e3b8afb04b94fca7580be9120452c238fc7a6e0fc8b697058de2603b081bd7a5d3c0e2da91801056bed31b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4efc52989955313d2025deab028253aa4112a7175c8c8a177968d5d27cacdff5
MD5 a29eb8f4562379f8eda57122a6c74098
SHA1 baec680acec455fa741d98db17e11a094d940fa3
SHA512 6b2aea3a73227bbfd191398ba84705eed5884f5bca4f2cfbca93698a1f5ce1c9053b97f0bf4801fe205ec25604afff0a96aa0d3c1e20537dbe4a2d8b93acb2cf
MD5 SHA1 SHA512

Submit Download

svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBAACCABCCBCABABBCABCBCCBAACCACCBABCACBABCABABBBCCAC.exe
Size 18.6MB
SHA256 c981b107eec559a05e77f309e595124203fb42d3d703a8a31a49a33bb807e7a7
MD5 9ceb6f872e8a681c26a705d6ff8e8c00
SHA1 5e8fe487611aaa5462a026e0e49cf3b246a44fb0
SHA512 4b6767f3019b2f04f5cb066654034172373b54bd07b3ec6d1140bb6c3c9629fa61677646ae2f5e6b88e278b36043147cccba57c4a2e69d79267045e88524e843
SSDEEP 196608:anSunSunSunN7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouH:a111NahvQHrc8u3xXJ/f4uUWHM
TLSH
T18117BF17F64780E5C42AE2B48A8B8337D7B57C044331ABDB6695A71A2F33BE4573A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 0784532721d35a0c83728149fa7ecb642b786cb2d22a08ccc51f432837d0322e
MD5 5c22d999353ca2acbbd961e393c61953
SHA1 46eeb0a09dedb130c12946c8c8e32e762459fa87
SHA512 31a92991f06d71dc38ed21664c2b33682bcc8439e06bb571b004b03273185540b0cd627d407560d7f52b3321319044865d3c5179dca577bf8a715b9b39aadffa
TLSH
T1D911572175B9CC73E431F8CF5A219EC31CEC778A9C1C6E21E21E0118A765C718E62CE6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3236-34-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/3492-81-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/4880-0-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Download

memory/4880-8-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Download