71aa16bf63f85607bc5d614392c33300ab8ce99c1ea308e796814907b3c855da

Analysis

max time kernel
151s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_eab746fc7d580891d216f099694a81de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Size 29.8MB
Sample260810-ece1rszhlc
SHA256 71aa16bf63f85607bc5d614392c33300ab8ce99c1ea308e796814907b3c855da
MD5 eab746fc7d580891d216f099694a81de
SHA1 969bffdcb07a57717fba9042b686117fa1297023
SHA512 d3b28a9bed9bf8da2f8590129ac8ac08bc2f62240cfbdeb0d33b19d27014747ab88344f04434ffcff5612d47becfe1a2878f79424bb1b07c7aa158ee21e2f805
SSDEEP 393216:iZahvQHrc8u3xXJ/f4uUWHn8KwekymImHN6+JrvD:iSvQHrK5/f4uUeebrL
TLSH
T105679F26A7A681E9D46FD17899678332E7717C51073163CF06E8E61A2F337A05E3A331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c492-18.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c492-18.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c492-18.dat	INDICATOR_EXE_Packed_Yano

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c492-18.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4132	svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe
1992	svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe
1964	svchost_CCACABCCCBCBABBABCAABABABCAACCAACBCACCBBABBCABCBBABCBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBCACBAACACBAACCCCBBCCABACACABAABAABBBBABACCCBCCBBCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe"	2026-08-10_eab746fc7d580891d216f099694a81de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCABAABBBCACCACBBBBBBBACACBCBCBCACCCCBCBBBBBACACACABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACABCCCBCBABBABCAABABABCAACCAACBCACCBBABBCABCBBABCBCA.exe"	svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2924	sc.exe
4156	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5044	cmd.exe
5504	cmd.exe
2624	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACABCCCBCBABBABCAABABABCAACCAACBCACCBBABBCABCBBABCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_eab746fc7d580891d216f099694a81de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3668	2026-08-10_eab746fc7d580891d216f099694a81de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
3668	2026-08-10_eab746fc7d580891d216f099694a81de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
3668	2026-08-10_eab746fc7d580891d216f099694a81de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
3668	2026-08-10_eab746fc7d580891d216f099694a81de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
4132	svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe
4132	svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe
4132	svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe
4132	svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe
1992	svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe
1992	svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3668	2026-08-10_eab746fc7d580891d216f099694a81de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Token: SeDebugPrivilege	4132	svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe
Token: SeDebugPrivilege	1992	svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 5504	3668	2026-08-10_eab746fc7d580891d216f099694a81de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	92
PID 5504 wrote to memory of 5396	5504	cmd.exe	94
PID 3668 wrote to memory of 2624	3668	2026-08-10_eab746fc7d580891d216f099694a81de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	95
PID 2624 wrote to memory of 2924	2624	cmd.exe	97
PID 3668 wrote to memory of 5044	3668	2026-08-10_eab746fc7d580891d216f099694a81de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	98
PID 5044 wrote to memory of 4156	5044	cmd.exe	100
PID 4132 wrote to memory of 488	4132	svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_eab746fc7d580891d216f099694a81de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_eab746fc7d580891d216f099694a81de_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACACABBCACBABCBABBABBCAABABBACACACAABCABCBCABBACBBCBBBCCCBABBCBBCABAACBBBACBCACCAACCACBABCACCCBAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5504
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACACABBCACBABCBABBABBCAABABBACACACAABCABCBCABBACBBCBBBCCCBABBCBBCABAACBBBACBCACCAACCACBABCACCCBAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCCACABBBCCACCAABAAACBCBABCBCACBACAABCCACCCACABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe" start= auto displayName= "UserDataSvc_BCCCCACABBBCCACCAABAAACBCBABCBCACBACAABCCACCCACABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCCCACABBBCCACCAABAAACBCBABCBCACBACAABCCACCCACABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe" start= auto displayName= "UserDataSvc_BCCCCACABBBCCACCAABAAACBCBABCBCACBACAABCCACCCACABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCCACABBBCCACCAABAAACBCBABCBCACBACAABCCACCCACABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCCCACABBBCCACCAABAAACBCBABCBCACBACAABCCACCCACABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4156

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACABCCCBCBABBABCAABABABCAACCAACBCACCBBABBCABCBBABCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACABCCCBCBABBABCAABABABCAACCAACBCACCBBABBCABCBBABCBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 b0e0254d2ad423546d7f6198bb7775718798d9ebbb4a28289b8688c6b89ec462
MD5 c49176aabf5d0fd29c5e2284687570ed
SHA1 6ee0b440ddebc031d3905119fb0ccf3099336338
SHA512 c9b8df02fa22a0dcfea5fb4c7b8d72979932cae08dd49d0c4cac630a5186ac32bdca856db92c26061e797741089d483d4ebc46798f3af7ffbbe776497050c30b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5aa7456363860b47b1d69e22ad75744f50e606112142a3f1b5f9ac7b576d8ae9
MD5 69a5a1ccd014d48560d96150e388e8ec
SHA1 595c29d8d1f0a7052e6eed2697979ef2b23552e6
SHA512 1b448490562d75f0d5a7c7c08a4700253ed2ed6c693ee53b5ab36bc9636d8fea7133ec87c183072901e218f78e36614d2f57fe2a5974974a708684011080b118
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 52e25e04d5fb2499900bce86474782a970f010b06360024d3cc2cc9bc056d712
MD5 dfbdd0efb87a28fd518a5290690f07c0
SHA1 5986a6f949ba3d54fe92dea346ebb2223af80091
SHA512 5ca86ccdff0acd596c85a759652f65f35f28917cfa6ebcf33f567be50073248c7026a6b80503d7f68b8ffd5514819696a71747a546b696776493cb7eadf9d9c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a275665524487948049c8bc73b6a5b08a661974349efcba0d54183d4a509dd19
MD5 81ad2a85bfcf79936cfbd075009760d3
SHA1 81170e06b5beca911b53d36eb9d407c8787a4517
SHA512 4cc29b8dd5debc3ecc750d037acfc55d2074c4eb4c28dc5834081dd2bcbbe9faab8b7a6543eeb4dce15fd36c42570fd6002257e0c834fd07ccc66111f42d52ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b16b1630d78835f0f39940534e4b94fe5af1e46ff22952b00a2b7776c32b29e3
MD5 bd2927ad1695f9787c09c5a7828a1ef3
SHA1 7831a669adf09a9294450d1c3a4b19ef36101c3c
SHA512 c3b589e9f24beb2259a2dd92851bd777c8b9a9000614fc66b844be4feffd524d772c1cedfede65257e5e77a01a6bd0b7f0232fac6fe591de74147e0f51119913
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cdf728d5b6822fa41a28677bbabd5d92be4514beeb87155bfd67af3e89994ec9
MD5 a23ad62ae254cecfe7a804e19c5b55c8
SHA1 f8b9148de21e19f5afce2a81391ff838569f75c4
SHA512 5c8c84dc40c44b463d2e6ed479c42a52c6f9b43b6cb715af4d7b7d87053560815ed22e223bdf9f653d3bfb86444851c57634b1a19c4cb66dcc5d17639250a4b6
MD5 SHA1 SHA512

Submit Download

svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBBBCBACBBCCBCACACACCBAACCBACABCAAACABAACBBCBBCABC.exe
Size 29.8MB
SHA256 71aa16bf63f85607bc5d614392c33300ab8ce99c1ea308e796814907b3c855da
MD5 eab746fc7d580891d216f099694a81de
SHA1 969bffdcb07a57717fba9042b686117fa1297023
SHA512 d3b28a9bed9bf8da2f8590129ac8ac08bc2f62240cfbdeb0d33b19d27014747ab88344f04434ffcff5612d47becfe1a2878f79424bb1b07c7aa158ee21e2f805
SSDEEP 393216:iZahvQHrc8u3xXJ/f4uUWHn8KwekymImHN6+JrvD:iSvQHrK5/f4uUeebrL
TLSH
T105679F26A7A681E9D46FD17899678332E7717C51073163CF06E8E61A2F337A05E3A331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 328ac191868d39f9373b8afa3d7d64208904ea34a4acc0345d10e330c2cd6059
MD5 d5629786eeb84ebff760a0054dbcff41
SHA1 a473da5cf2d65617f013a9065ce11abc6a8b00ce
SHA512 99c538dad3d2cf386ef9bff7237567b08442d7cfb1c1657c413bee62cd6097f71cefc9d2dbeead875ae7128550372b8d8427d7657dac8d0c8b3b62b5059f9503
TLSH
T10311EBC1F4E9D853F93268EA551BDBE308A87A8FBC5C6A74230D06187B99C33CE550D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1964-72-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/1992-65-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/3668-6-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/4132-35-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/4132-22-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download