dc5030c78aef0f57bb9a428ff7a4ed6da88601bae44de91ff6e89244fbf67852

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_caae35571a7509c453baa49271257f53_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 16.7MB
Sample260808-vsq1za1emb
SHA256 dc5030c78aef0f57bb9a428ff7a4ed6da88601bae44de91ff6e89244fbf67852
MD5 caae35571a7509c453baa49271257f53
SHA1 f8e1f33e61a8fb573effe67badb489914974b444
SHA512 1d9fc18c7be83a394f79de7219dff41e6423eabba82ba4477a2b63ed59e490134cd3e30b44a4a4eebab1a5efa682c4b29704fb6aeeaa87e6999bb1408257abd4
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouH:iZahvQHrc8u3xXJ/f4uUWHa
TLSH
T15F07AE13B35A81E6C02AE2B88A574222D7BA7C440334A7DF12D5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002423f-22.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002423f-22.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002423f-22.dat	INDICATOR_EXE_Packed_Yano

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002423f-22.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2844	svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe
4104	svchost_BBCACBBACABACCAAABABCCCABCACCBCCAABBCBBBCBBCAACBBABAACC.exe
2640	svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAAACBCAACCBACCAAACBBABAAAACBBABBBBBBBBAAABCAACCCCACAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe"	2026-08-08_caae35571a7509c453baa49271257f53_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCBACBCABCCAABABABCAAAAACBACACCABACBABAABBACBABBCACAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCACBBACABACCAAABABCCCABCACCBCCAABBCBBBCBBCAACBBABAACC.exe"	svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1912	sc.exe
1632	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2380	cmd.exe
2760	cmd.exe
1512	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_caae35571a7509c453baa49271257f53_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCACBBACABACCAAABABCCCABCACCBCCAABBCBBBCBBCAACBBABAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3824	2026-08-08_caae35571a7509c453baa49271257f53_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
3824	2026-08-08_caae35571a7509c453baa49271257f53_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
3824	2026-08-08_caae35571a7509c453baa49271257f53_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
3824	2026-08-08_caae35571a7509c453baa49271257f53_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
2844	svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe
2844	svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe
2844	svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe
2844	svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe
4104	svchost_BBCACBBACABACCAAABABCCCABCACCBCCAABBCBBBCBBCAACBBABAACC.exe
4104	svchost_BBCACBBACABACCAAABABCCCABCACCBCCAABBCBBBCBBCAACBBABAACC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3824	2026-08-08_caae35571a7509c453baa49271257f53_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Token: SeDebugPrivilege	2844	svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe
Token: SeDebugPrivilege	4104	svchost_BBCACBBACABACCAAABABCCCABCACCBCCAABBCBBBCBBCAACBBABAACC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2308	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 2760	3824	2026-08-08_caae35571a7509c453baa49271257f53_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe	100
PID 2760 wrote to memory of 3736	2760	cmd.exe	102
PID 2844 wrote to memory of 1724	2844	svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe	103
PID 1724 wrote to memory of 3544	1724	notepad.exe	104
PID 3824 wrote to memory of 1512	3824	2026-08-08_caae35571a7509c453baa49271257f53_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe	108
PID 1512 wrote to memory of 1912	1512	cmd.exe	110
PID 3824 wrote to memory of 2380	3824	2026-08-08_caae35571a7509c453baa49271257f53_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe	111
PID 2380 wrote to memory of 1632	2380	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-08_caae35571a7509c453baa49271257f53_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_caae35571a7509c453baa49271257f53_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBACABBCCCCCCBABCBBACBBCCBBCACAABCCCABAAAABAACCBCBACCACBCCCABBBACCACCCBBCABBAABACCAAACCBBBCBBBBBACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBACABBCCCCCCBABCBBACBBCCBBCACAABCCCABAAAABAACCBCBACCACBCCCABBBACCACCCBBCABBAABACCAAACCBBBCBBBBBACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCACBCCACCCAAAABBBCACACBBAABCCCBACBCCBBABBCCAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe" start= auto displayName= "UserDataSvc_BCBCACBCCACCCAAAABBBCACACBBAABCCCBACBCCBBABBCCAACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCACBCCACCCAAAABBBCACACBBAABCCCBACBCCBBABBCCAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe" start= auto displayName= "UserDataSvc_BCBCACBCCACCCAAAABBBCACACBBAABCCCBACBCCBBABBCCAACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCACBCCACCCAAAABBBCACACBBAABCCCBACBCCBBABBCCAACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCACBCCACCCAAAABBBCACACBBAABCCCBACBCCBBABBCCAACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3544

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACBBACABACCAAABABCCCABCACCBCCAABBCBBBCBBCAACBBABAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACBBACABACCAAABABCCCABCACCBCCAABBCBBBCBBCAACBBABAACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe
1⤵
- Executes dropped EXE
PID:2640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 505b78ea75bd05ed0059f34be2eac34162cd60f60e0e54eb17a9b2a2597f329c
MD5 cab299b243186289eef50f215cd8a7d0
SHA1 b96adf017f5e79b9dc29f6d4cb79ca2da93b5d38
SHA512 0fa1b1afa7f00b7f1cf2bf961629056ce7e1ac1bf3855ef6bcc5a3504c40957a552e55a59144ffeae85390090f69c5eb133ee089b233ece3c9471f8f5273fbda
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1ea4c66d56339740c7c6b72ce5f17a25801ab0734a7a07f5198b97bf8f1e6f4a
MD5 3bfdabc47b07df3d2097ea31aa8ab213
SHA1 726d88ebb9623a8ffa3486bdc2652467d3225b2d
SHA512 b19fe89cb2d27f772ef110ae8effa6dfd9a9a72bf67f5360990c6b52ed7c56cdbefdeb4dd27019b844bcf7e4e14d0b3875262897d41582520201a3617af287e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ad5e2151b33205c6060c70851283ad4150170247043baabc34996ccb8512a4ad
MD5 43b2ecfea02629e433bedee17de30c97
SHA1 ba3ac964b8de5f91a6580b930fdb66d26a1d673f
SHA512 f24264ad103c7611b3463d44558024119bbaecbb6e65820501efccfb079fdf396f6a2e8eff90f7b93e39ee13b8a572af5d9ee778aeff165c8243dcd2ef641b64
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a05327e1f1f0024061a7547683944dffccd02bd60c91a78f35a54b3d30c14b90
MD5 628f4322c6ba385b292f3a30e5597cb7
SHA1 e5a6460f4b53b3ad1a5896123724635ad78d773f
SHA512 12733c76747b74bafea3b94716da646439397cbeabe9f1103122a34bc9c2d3dcdf7276915a3df16de89926ca2ca80e4f69477f9f5058bb0712bea96a741bdfa4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7722903c00bf7005c6c77e1c0bb1e148a603f45ef2d904574b4ee042e5cb4b1b
MD5 b1d604ef12224d847863b983d2e394e5
SHA1 39757d77472d8f830f430a69d2ff1a564b946c36
SHA512 eee75a3c9083fb31a5f19327e8a01481f9d30c1d5139d0f3a4cc8f50b919eaa70debae1ca3b6f0073039481851d8404d2a7c9ec80faf4bcef1a50e2f22a22699
MD5 SHA1 SHA512

Submit Download

svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBAACCCBCCABAABBCBCCCCACBCCCCABACCABBCCBCBCCBBACBAC.exe
Size 16.7MB
SHA256 dc5030c78aef0f57bb9a428ff7a4ed6da88601bae44de91ff6e89244fbf67852
MD5 caae35571a7509c453baa49271257f53
SHA1 f8e1f33e61a8fb573effe67badb489914974b444
SHA512 1d9fc18c7be83a394f79de7219dff41e6423eabba82ba4477a2b63ed59e490134cd3e30b44a4a4eebab1a5efa682c4b29704fb6aeeaa87e6999bb1408257abd4
SSDEEP 196608:kFlP7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouH:iZahvQHrc8u3xXJ/f4uUWHa
TLSH
T15F07AE13B35A81E6C02AE2B88A574222D7BA7C440334A7DF12D5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 3ad6cfb0d4ca7a8153ae1a9ebdacf665e5590131f5b3e3ff88db619a8c889246
MD5 d8dc0a8181c2c1fa17daa6af24befc73
SHA1 45f2717a7cf2d37ee5710a7c9dddf4df4de5f211
SHA512 fe806744c74f2841a557ae6cf396354e453e406d5bdd64b77aad4be423fc7886eee3033a31c1189241037bb5d473fd1e854ef045509f0da60d8ee1e5eb6bfb69
TLSH
T1FF110850B4A99893ED32B8CB5F1989D228A433EBAC586A675308C7096F948338E058D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1724-58-0x0000000004F40000-0x0000000004F41000-memory.dmp

Download

memory/2640-89-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/2844-26-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/2844-36-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/3824-7-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/3824-0-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/4104-87-0x0000000000830000-0x0000000000851000-memory.dmp

Download