b3bef31e19d4172d8ddd05450fcf475f240166890db12372d626ab7eebb60c90

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_623b3e1ff2db9a50c186338bcdda7e81_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 17.0MB
Sample260810-c1fabszbqd
SHA256 b3bef31e19d4172d8ddd05450fcf475f240166890db12372d626ab7eebb60c90
MD5 623b3e1ff2db9a50c186338bcdda7e81
SHA1 fe99cac6589594a4336d07b3da2d9530b6c1dd9f
SHA512 4f296e4f8b76a42b89616c36928cc49b8515d97f4e58a9c04dffe1c681fa79a66c8177f1f33c6452c09bace2c6c728009fc98e3551e54f79d33429931921cd3d
SSDEEP 196608:vBBBBo5T7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou0:A5TahvQHrc8u3xXJ/f4uUWH5
TLSH
T18E07AE13B35681A6D06AE2B8CA5B4322D7B97C400734A7DF12D4B7692F33BE4973A351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c58f-19.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c58f-19.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c58f-19.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5996	svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe
5032	svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe
5500	svchost_AABBCABBBABACACCBCCAACACBAACAABBBCABABBCBAACACCCBBAABBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCBAACBBCBBBCBAACBABACAAACCAACBBACACBCBCCCBBABBBCBABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe"	2026-08-10_623b3e1ff2db9a50c186338bcdda7e81_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAAAACBCAACBBBACCCCBBCBAABAABABCAACACBCBCCCABCCBAAAACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBCABBBABACACCBCCAACACBAACAABBBCABABBCBAACACCCBBAABBB.exe"	svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4236	sc.exe
1072	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
476	cmd.exe
3716	cmd.exe
5020	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBCABBBABACACCBCCAACACBAACAABBBCABABBCBAACACCCBBAABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_623b3e1ff2db9a50c186338bcdda7e81_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4656	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1492	2026-08-10_623b3e1ff2db9a50c186338bcdda7e81_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1492	2026-08-10_623b3e1ff2db9a50c186338bcdda7e81_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1492	2026-08-10_623b3e1ff2db9a50c186338bcdda7e81_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1492	2026-08-10_623b3e1ff2db9a50c186338bcdda7e81_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5996	svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe
5996	svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe
5996	svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe
5996	svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	2026-08-10_623b3e1ff2db9a50c186338bcdda7e81_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	5996	svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 5020	1492	2026-08-10_623b3e1ff2db9a50c186338bcdda7e81_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 5020 wrote to memory of 4656	5020	cmd.exe	94
PID 1492 wrote to memory of 476	1492	2026-08-10_623b3e1ff2db9a50c186338bcdda7e81_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	95
PID 476 wrote to memory of 4236	476	cmd.exe	97
PID 1492 wrote to memory of 3716	1492	2026-08-10_623b3e1ff2db9a50c186338bcdda7e81_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 3716 wrote to memory of 1072	3716	cmd.exe	100
PID 5996 wrote to memory of 5788	5996	svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_623b3e1ff2db9a50c186338bcdda7e81_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_623b3e1ff2db9a50c186338bcdda7e81_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACCBAABCCBCBCAACCCBCCCCABABAAABCCBBAAABACCCCCCACBBCBCABCBACBBABAAACBAABACBCACCCCABACCCCBCCCCACACCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACCBAABCCBCBCAACCCBCCCCABABAAABCCBBAAABACCCCCCACBBCBCABCBACBBABAAACBAABACBCACCCCABACCCCBCCCCACACCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACAACCAABABCABBAAACACABBBBAAABCABCCBBCAAACACCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe" start= auto displayName= "UserDataSvc_BAACAACCAABABCABBAAACACABBBBAAABCABCCBBCAAACACCCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:476
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACAACCAABABCABBAAACACABBBBAAABCABCCBBCAAACACCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe" start= auto displayName= "UserDataSvc_BAACAACCAABABCABBAAACACABBBBAAABCABCCBBCAAACACCCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACAACCAABABCABBAAACACABBBBAAABCABCCBBCAAACACCCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACAACCAABABCABBAAACACABBBBAAABCABCCBBCAAACACCCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1072

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe
1⤵
- Executes dropped EXE
PID:5032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCABBBABACACCBCCAACACBAACAABBBCABABBCBAACACCCBBAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCABBBABACACCBCCAACACBAACAABBBCABABBCBAACACCCBBAABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8287a5a1796f4835da6ed81f77c86f534f37ebd278393ae443f32bf36928de4f
MD5 64f4b4b2a04af8edbd5faf83a49508d8
SHA1 60ed6583f8c5e24d6b23dcf75383782a2de0a0c0
SHA512 67b53fe0848a27acb041fd691688c1be386bd1a937334d13b48a70fccf03131ef3b42452378bdd85953e8ba6768ec40cc1ccd3920ab0a8e4da56fea6aca37f77
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a8e038386d814298fba2618b118905757e6cc89799dfe4cd2230353a595735ff
MD5 c6217ed4545f985278b70d333c690da9
SHA1 bf6a37d9159e79da5991a633d600c5b405b24016
SHA512 c8283c87366a700162d64e0a3ff29518ec836ee3ceafe09649b491ffbc7302396b9e9b3dc6e587271cad1c423784e13f4d4e432bbfd157eacef14b597fefc912
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 39649adde6438382ad19d7b5e01420eaf13f8ccf0eeaa4250522028079223759
MD5 02ba462eb77de5865ee3c6e2b6d13c38
SHA1 a94f55136c557fb3ce770207ab628790e9e33c6d
SHA512 3a124abdc71e38db1406dd2e9a1defe90e98eee3704885c76bfd8addcf5894f8e640d620847fed28a57023be8b116e3708ccb9cab57f01c154ea1a52156b1b94
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 48fbeab5746c8d49dfab3a567d9a6837c5d7a7be268115350c3d3a5b6aec2dae
MD5 cf3bd52f2e63bbd61cc7569da8129eba
SHA1 ebddb09c12a6ac4f3d0893575f650cd071586c6f
SHA512 565b76e21c4747eb0c8ee56e8907a31a4e9aced3ff7fd8e61c136dcbb79c95810fd93bc109f8de0e1e6a5792eca75375af4af5a43ed25d595d3c23e5e7722098
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 46b2f4aacf2922a11fac2edf0286ead46f85ff8592b11681c85ef70333592bfd
MD5 c25e1c4164c192259f7b982a7f55a32a
SHA1 a6d63773b3d6fd3df024cd0a6375021b5b91cbf3
SHA512 48783c3b186da32fd8fc62bde1adc3c32f04b5b5f28c6f0a5d015cedfc1c872ee2c28925f4956afbdd5ee30047d4c78ba22f382650545e8b29ae2c5ac614ccd6
MD5 SHA1 SHA512

Submit Download

svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBACCACBCCACACBAABAABBACABCBCCBCBAACACAACCBAACCCA.exe
Size 17.0MB
SHA256 b3bef31e19d4172d8ddd05450fcf475f240166890db12372d626ab7eebb60c90
MD5 623b3e1ff2db9a50c186338bcdda7e81
SHA1 fe99cac6589594a4336d07b3da2d9530b6c1dd9f
SHA512 4f296e4f8b76a42b89616c36928cc49b8515d97f4e58a9c04dffe1c681fa79a66c8177f1f33c6452c09bace2c6c728009fc98e3551e54f79d33429931921cd3d
SSDEEP 196608:vBBBBo5T7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou0:A5TahvQHrc8u3xXJ/f4uUWH5
TLSH
T18E07AE13B35681A6D06AE2B8CA5B4322D7B97C400734A7DF12D4B7692F33BE4973A351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1492-0-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/1492-7-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/5032-67-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download

memory/5996-23-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download

memory/5996-36-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download