ee95a1512f939a22c3a9ef3b68c99011201fc258f3b7645b31cf21cd14db8c71

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_22b5e25bece753f18a90efce0cf3a4b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 16.3MB
Sample260808-twvmwsed56
SHA256 ee95a1512f939a22c3a9ef3b68c99011201fc258f3b7645b31cf21cd14db8c71
MD5 22b5e25bece753f18a90efce0cf3a4b3
SHA1 703edb36355b2c3f66085423954924309d379151
SHA512 b8716fbcbb64cfb7c7ec1af564b413d41299ece14a49a31896622cf1fc6df0d2ea63acff2899a32cf875a0960a91bf9fecca2fa1b244d429df8bbb6b12bc4326
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou5:iZahvQHrc8u3xXJ/f4uUWHU
TLSH
T11407AE13B35681E6C42AE2B88A474223D7BA7C440334A7DB16D5B7692F37BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c538-18.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c538-18.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c538-18.dat	INDICATOR_EXE_Packed_Yano

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c538-18.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3160	svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe
4840	svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe
2320	svchost_BCCABBCBCBBAAABCABCACCAABCABACAABCCBCBBCBCAAACABCABCBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCCABBCACCCBCBABCCACCCCCCABACACBBBBAACBBCCAACCACCBBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe"	2026-08-08_22b5e25bece753f18a90efce0cf3a4b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCAABBAAABABAAABBCABCBBBCAACABBCBACBACCCBACCCBBACACBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCABBCBCBBAAABCABCACCAABCABACAABCCBCBBCBCAAACABCABCBAB.exe"	svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5836	sc.exe
4880	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5736	cmd.exe
3780	cmd.exe
1136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCABBCBCBBAAABCABCACCAABCABACAABCCBCBBCBCAAACABCABCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_22b5e25bece753f18a90efce0cf3a4b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5400	2026-08-08_22b5e25bece753f18a90efce0cf3a4b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5400	2026-08-08_22b5e25bece753f18a90efce0cf3a4b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5400	2026-08-08_22b5e25bece753f18a90efce0cf3a4b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5400	2026-08-08_22b5e25bece753f18a90efce0cf3a4b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
3160	svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe
3160	svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe
3160	svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe
3160	svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe
2320	svchost_BCCABBCBCBBAAABCABCACCAABCABACAABCCBCBBCBCAAACABCABCBAB.exe
2320	svchost_BCCABBCBCBBAAABCABCACCAABCABACAABCCBCBBCBCAAACABCABCBAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5400	2026-08-08_22b5e25bece753f18a90efce0cf3a4b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	3160	svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe
Token: SeDebugPrivilege	2320	svchost_BCCABBCBCBBAAABCABCACCAABCABACAABCCBCBBCBCAAACABCABCBAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5400 wrote to memory of 5736	5400	2026-08-08_22b5e25bece753f18a90efce0cf3a4b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 5736 wrote to memory of 5760	5736	cmd.exe	94
PID 3160 wrote to memory of 1316	3160	svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe	95
PID 5400 wrote to memory of 3780	5400	2026-08-08_22b5e25bece753f18a90efce0cf3a4b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	96
PID 3780 wrote to memory of 5836	3780	cmd.exe	98
PID 5400 wrote to memory of 1136	5400	2026-08-08_22b5e25bece753f18a90efce0cf3a4b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	99
PID 1136 wrote to memory of 4880	1136	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-08_22b5e25bece753f18a90efce0cf3a4b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_22b5e25bece753f18a90efce0cf3a4b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBCABACCACCBCBABCAACBCBCABBBCACBAAAABCAACABABABABBAACCACCCCCABBCBCCBACAABBABBAABBBBACABCCBBBAABBACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBCABACCACCBCBABCAACBCBCABBBCACBAAAABCAACABABABABBAACCACCCCCABBCBCCBACAABBABBAABBBBACABCCBBBAABBACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBABACCACABBAABACCBABCCBCABAABBCCCCBBAACCACBAACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe" start= auto displayName= "UserDataSvc_CACBABACCACABBAABACCBABCCBCABAABBCCCCBBAACCACBAACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBABACCACABBAABACCBABCCBCABAABBCCCCBBAACCACBAACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe" start= auto displayName= "UserDataSvc_CACBABACCACABBAABACCBABCCBCABAABBCCCCBBAACCACBAACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBABACCACABBAABACCBABCCBCABAABBCCCCBBAACCACBAACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBABACCACABBAABACCBABCCBCABAABBCCCCBBAACCACBAACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1316

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe
1⤵
- Executes dropped EXE
PID:4840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBCBCBBAAABCABCACCAABCABACAABCCBCBBCBCAAACABCABCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBCBCBBAAABCABCACCAABCABACAABCCBCBBCBCAAACABCABCBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ce20db36f0e6ee0dbb0a9f98464a49932a60b4b2bdca9db1bc724e16e24ae13b
MD5 edac6a445fa76d4be73815d9b036d305
SHA1 d3b874d6179c8152fec31177e7e19e26fec98dc9
SHA512 ee13580392aad772068834b0a30b8e69cb3546e77d8b7805395b4b3fb370c9b0c44e795e091ba632c50da236fd931ce888960bb5eec6af084bdc9b89da79e441
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 22e7aa45a95dc38c5767a2dff55c49a34a8f482337cae602311c062dcb32550b
MD5 065c5a99539dbc47036c33728474a0c5
SHA1 ff8ec70018736344761250c82cc1b6801e73fc57
SHA512 f655033e3ff08444152a201502ba87c7996acc6c983d3a0e17289bf1d43bec68891967e192d2421d861c9b83f7fae1e0f7655271c3a3c73f1b0565a90814c8fb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ad8b1eea7d62f885c4f0cd111b8d5a1c30db45f5a900ebd2ac152913f8a5e7e7
MD5 6dd264b48083314982b418e35f1894f6
SHA1 eb8455dd0c8d672ad1ecc76508b301727c15c6d7
SHA512 0f09309b1bc3212530d0c0efd044513918617803c2317d2afff0326cb6d7b2c369c39a936b01d0dd354b4bdb6611e1cb6d87d99b04e5af20cf8e19c6554d93c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f5bab470fedb23c11c1fd4c38d64301be6fbddaaffc17632e526e412c57145f2
MD5 1b57af9bfff2d2fb28cd01f521f8188a
SHA1 1338e81893de2176e4e32d7f3a583fc65fd52bb1
SHA512 ac6edb1a69afd3e6def9c77d88df919109d06fd0b13d77476898be57743594cfc4d9c2371a3e29f8d745b5e6152eb1a5f8f0d23152a7a0e9c5958f2a62d0c1cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 10c2374e8b48e97650171bc23e419e98a9e22795a9cd702d49c60212594d7a3a
MD5 3bccfcd80f06ec2ad39e970f48998a47
SHA1 ab63fa9df6b04211cf034e67e300d1969d7481e1
SHA512 fa6774bcc5f7436025b0f70a80f5cbc7f6532ce4c5bc0e43256c5918a0c93dc7c7496f062670c789613f948635314293879ed03f44dcab5bcc9f7c7d4d7ea341
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e1abba9994fc31d35cc013461e6285cf38433c58543003cf36c9dee84626e16f
MD5 519199e2952203074cafda63ab18a564
SHA1 b6e7c40fb32964a915bea9289c0848bc13eec8f8
SHA512 d3e0db139f7bcb4ad7c2ff01c88594eb7681c160a9c2cbace6dba80c0f1a97b6e28afcb9c07fb178c38220870b990544532ff02e51e8f1f8ea77b65f292da14e
MD5 SHA1 SHA512

Submit Download

svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCACAACACCCBCBCCCCABCCBABCBBCBCCCBBAACBBACCBBCCCCBAC.exe
Size 16.3MB
SHA256 ee95a1512f939a22c3a9ef3b68c99011201fc258f3b7645b31cf21cd14db8c71
MD5 22b5e25bece753f18a90efce0cf3a4b3
SHA1 703edb36355b2c3f66085423954924309d379151
SHA512 b8716fbcbb64cfb7c7ec1af564b413d41299ece14a49a31896622cf1fc6df0d2ea63acff2899a32cf875a0960a91bf9fecca2fa1b244d429df8bbb6b12bc4326
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou5:iZahvQHrc8u3xXJ/f4uUWHU
TLSH
T11407AE13B35681E6C42AE2B88A474223D7BA7C440334A7DB16D5B7692F37BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5bad3676b11fe16b3c426f3b645bf401430f57858bcae787ab91a695e2b15ab6
MD5 abe01d80dd8411bd78f6946e14c3ace5
SHA1 f8c91bb65253ccaebe7e3970b9bd1e7499e2204b
SHA512 390f130d9789f63e30b5c8ab741240b9d06252dad3872b775c821c0a967c7751c5f3131617a53b3c6939363367954073738abc6d0b459573250b7454c773c650
TLSH
T1A51101A0B4AADC67E9326CDB9935C9D21CF437DBAC5C6E65530C411CAF86C328D168D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2320-81-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/3160-35-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/3160-22-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/4840-66-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/5400-6-0x0000000000250000-0x0000000000271000-memory.dmp

Download