9c015c99a6aeadeb39c997d009e9da8d48a7e6bbe9e6a3528349b62d7bcc7585

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_4847b4806ec2868155530d9eb452b14a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 16.8MB
Sample260810-c7fjnsdf85
SHA256 9c015c99a6aeadeb39c997d009e9da8d48a7e6bbe9e6a3528349b62d7bcc7585
MD5 4847b4806ec2868155530d9eb452b14a
SHA1 b3c4f5d316573426704152bfd6b6f12244e62468
SHA512 024f37ddd95d4d4466c4f878e00e5908278e2624a7166b7897b6933d964a20c9edb68d6a38d01abf8f9e48c54d2a3768617e1c3ee12adf24ea1f8f2e1e6f6bc6
SSDEEP 196608:vBBBBe7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToug:mahvQHrc8u3xXJ/f4uUWH9
TLSH
T1ED07AE13B34681B6D06AE2B88A5B4322D7B97C400734A7DF12D4B7692F73BE4973A351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5d0-19.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5d0-19.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5d0-19.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5836	svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe
1568	svchost_CACCBCBCBBCCACABBABCCACCAAABAACAABBCBCBAACCAABABCABBABA.exe
4392	svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBACCBBABCAAAABBABACBBABABBCCBCBABACCCACACBCBCABACACCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe"	2026-08-10_4847b4806ec2868155530d9eb452b14a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAABCACACACCACAACCACCBABACBAACABAAABCCBBACBBCCCCCBBBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCBCBCBBCCACABBABCCACCAAABAACAABBCBCBAACCAABABCABBABA.exe"	svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5936	sc.exe
5580	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2272	cmd.exe
4512	cmd.exe
900	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_4847b4806ec2868155530d9eb452b14a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCBCBCBBCCACABBABCCACCAAABAACAABBCBCBAACCAABABCABBABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1752	2026-08-10_4847b4806ec2868155530d9eb452b14a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1752	2026-08-10_4847b4806ec2868155530d9eb452b14a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1752	2026-08-10_4847b4806ec2868155530d9eb452b14a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1752	2026-08-10_4847b4806ec2868155530d9eb452b14a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5836	svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe
5836	svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe
5836	svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe
5836	svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe
1568	svchost_CACCBCBCBBCCACABBABCCACCAAABAACAABBCBCBAACCAABABCABBABA.exe
1568	svchost_CACCBCBCBBCCACABBABCCACCAAABAACAABBCBCBAACCAABABCABBABA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	2026-08-10_4847b4806ec2868155530d9eb452b14a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	5836	svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe
Token: SeDebugPrivilege	1568	svchost_CACCBCBCBBCCACABBABCCACCAAABAACAABBCBCBAACCAABABCABBABA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2272	1752	2026-08-10_4847b4806ec2868155530d9eb452b14a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 2272 wrote to memory of 3932	2272	cmd.exe	94
PID 5836 wrote to memory of 4104	5836	svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe	95
PID 1752 wrote to memory of 4512	1752	2026-08-10_4847b4806ec2868155530d9eb452b14a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 4512 wrote to memory of 5936	4512	cmd.exe	100
PID 1752 wrote to memory of 900	1752	2026-08-10_4847b4806ec2868155530d9eb452b14a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	101
PID 900 wrote to memory of 5580	900	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_4847b4806ec2868155530d9eb452b14a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_4847b4806ec2868155530d9eb452b14a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBAAABCBCCBAACCBABCACBABCACBABABCAAAABAACCCCABBCBBCACCACCAABAAACAABACACABBBBBACBAAABAAABABACACCBACBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBAAABCBCCBAACCBABCACBABCACBABABCAAAABAACCCCABBCBBCACCACCAABAAACAABACACABBBBBACBAAABAAABABACACCBACBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCAABCBCCBABBCBBCBACCAABBCCBCBAABCCBCBBCBBCABBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe" start= auto displayName= "UserDataSvc_BCBCAABCBCCBABBCBBCBACCAABBCCBCBAABCCBCBBCBBCABBACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCAABCBCCBABBCBBCBACCAABBCCBCBAABCCBCBBCBBCABBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe" start= auto displayName= "UserDataSvc_BCBCAABCBCCBABBCBBCBACCAABBCCBCBAABCCBCBBCBBCABBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCAABCBCCBABBCBBCBACCAABBCCBCBAABCCBCBBCBBCABBACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCAABCBCCBABBCBBCBACCAABBCCBCBAABCCBCBBCBBCABBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBCBCBBCCACABBABCCACCAAABAACAABBCBCBAACCAABABCABBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBCBCBBCCACABBABCCACCAAABAACAABBCBCBAACCAABABCABBABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe
1⤵
- Executes dropped EXE
PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5096d43351ad8020d1ed1b8930eb5ce10dab929e84b8e0a9d7d684e2790dd8ff
MD5 0293e0cd8a19877cb7dac6e05ee39396
SHA1 7cdd29f075d0fd3ab8056ee0b88ac8720648ca79
SHA512 f01f70672f1f6f6d2c4e0ac4363ecb3365a7fbd2200b492091258d736422cdbb5f6b9d5b182c8f0f1f69bab00d17279c12e5a54fa91f651e4a1926d24b5682b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dcd6a63781a44ea8ff5b7cf07d9a59a85c660d0e90f93280cefdfccdbb22fd4e
MD5 8f7aa9e40101d0794b0e575ef4beaf24
SHA1 58602a5836b22c1dada4b22344273eadeefb995e
SHA512 b94917eaebcd66e16a7f195f2718a11ab49e1124b389ac0e0080e764c0ce23f6672c9a42786c95750b6e2295cb855f4e22d214675d4e293c7549272407be03e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5bde4272d8a12c04aa8fba229ba58aa38b97b8cbe840a75ac44eab8565ab8421
MD5 6e9d1bffd4d98b601577aa2c4c16a18e
SHA1 ef8d7a87b8036f0359a0f932517ec574617fd1e0
SHA512 882afc7023aaa998944f7096b5496ad502f27c002e2983f441a6b910fe09bf4ba45b0d5a11365c9c67ff58f6867bf4f25078578337e9704aaa2881dbf76b7ac4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e1caca98363479049c208322fc3f7a949f0f9bfc46db90a65c9e7d48f667f392
MD5 23ade261cc58f1c1eec88b1e894bf175
SHA1 317d2a4fee83952a4c8a5a969d4b4c3c50aacb78
SHA512 0071277b923f50cd43a52c51db61f4e63b1f96c7f84316a2bf265924de187b777dc006d265966c587c3bdf1f83cb7fb7e2617d2ac00cd52d66b180f552653779
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0c523f70a8a69e23c4aa447ad6fee66cc7ac9999f0e0966c26f4a3c68b38c9a5
MD5 11fbb1bacdb17481ccfbd58096b8bd7a
SHA1 3e74ec0e1b1ec52d2c93bfc5b0a95b208f3a157e
SHA512 865f10866016b324a2b8ad4ed7d589f8c5f3953bac11b400cb7d6590c9e1bdef20baf5fdb763268aea197209f2ca5c0f438d44cae41031c919a6faa84287a41f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7ee83859a83e631bac4f221fd812a59e1e2a8a9e9b605e06a8654c08eb265d23
MD5 bd4e06f731b45e305db9dcf9aba3129a
SHA1 02b06707ff88ccda23dcddbdfd3989322506bd06
SHA512 e7538eb58a75fc018567eae1fc9e39f19c5f1d163efe2cd46cc0df6a22a70a0505d63c8e57ee1b09616f2c42509a0fd5820db569ec876a5fc5f7fff85f5ea642
MD5 SHA1 SHA512

Submit Download

svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBBBBBACAAAAACBCCCBCAAACCABAABBAABCACCBAAAACBABBAB.exe
Size 16.8MB
SHA256 9c015c99a6aeadeb39c997d009e9da8d48a7e6bbe9e6a3528349b62d7bcc7585
MD5 4847b4806ec2868155530d9eb452b14a
SHA1 b3c4f5d316573426704152bfd6b6f12244e62468
SHA512 024f37ddd95d4d4466c4f878e00e5908278e2624a7166b7897b6933d964a20c9edb68d6a38d01abf8f9e48c54d2a3768617e1c3ee12adf24ea1f8f2e1e6f6bc6
SSDEEP 196608:vBBBBe7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToug:mahvQHrc8u3xXJ/f4uUWH9
TLSH
T1ED07AE13B34681B6D06AE2B88A5B4322D7B97C400734A7DF12D4B7692F73BE4973A351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7cb736e1c3dae5c962a5fa65f982051d9d781007766ff66362db9b5ed09cf7fb
MD5 b64e592dccfd1bb3a21207ab1644f873
SHA1 283aa8df0b574b73f6f783b60a8c7ea3e52545d7
SHA512 49a9e3d92a2871f0d739b730da48a09e065f7fff0a262d10ab2d924280b6f90b7be27a3426beffba70f625d4b2790571abba6ab2174f490ef06cfef531c67804
TLSH
T19411276194B9CC57F932A8CB7A1DDAB20CF4379F689C6E04B3094218BB99C30DD558E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1568-79-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/1752-0-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/1752-7-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/4392-81-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download

memory/5836-33-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download

memory/5836-23-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download