6cd42f5c479be9d1a96b7531f8f91c36d22f6c74fbe054a90b7d7e523e1179b3

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_b69ce7ff09aab4f9237ecd2ad2424996_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
Size 53.9MB
Sample260810-epb5ms1bma
SHA256 6cd42f5c479be9d1a96b7531f8f91c36d22f6c74fbe054a90b7d7e523e1179b3
MD5 b69ce7ff09aab4f9237ecd2ad2424996
SHA1 c5392c8d9b6285b924b1e54121fd16552116ef37
SHA512 15d1cbd1bf4b636a5e5316f4ae12054e1a255b3d6c3032100359c4d9609a58b34016ce6897abfc36f56e5b38093ed15b6fab2fc0792b15f2308e5a2633661a4f
SSDEEP 786432:iSvQHrKaSvQHrKaSvQHrKaSvQHrKaSvQHrKEEIvW:iSvQHWaSvQHWaSvQHWaSvQHWaSvQHW8W
TLSH
T102C7AD27F29900E5C42ED178C65B8623DA7A7C554724AADF06A077252F33BF01B3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3392	svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe
4984	svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe
5880	svchost_CCCCCCCACCABBCABCBCBBABACACCACABBABAABCABBABCBACABBCBCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBBCAAABAACCCBBCCACBACAACBBCACAACABCACBCAAAACCCCCBBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe"	2026-08-10_b69ce7ff09aab4f9237ecd2ad2424996_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCCACABBBACACABBACCBACBBBACACABACBACCACCAAAABBACACCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCCCCACCABBCABCBCBBABACACCACABBABAABCABBABCBACABBCBCC.exe"	svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5948	sc.exe
3296	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4908	cmd.exe
5812	cmd.exe
4756	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCCCCACCABBCABCBCBBABACACCACABBABAABCABBABCBACABBCBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_b69ce7ff09aab4f9237ecd2ad2424996_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3576	2026-08-10_b69ce7ff09aab4f9237ecd2ad2424996_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
3576	2026-08-10_b69ce7ff09aab4f9237ecd2ad2424996_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
3576	2026-08-10_b69ce7ff09aab4f9237ecd2ad2424996_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
3576	2026-08-10_b69ce7ff09aab4f9237ecd2ad2424996_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
3392	svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe
3392	svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe
3392	svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe
3392	svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	2026-08-10_b69ce7ff09aab4f9237ecd2ad2424996_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
Token: SeDebugPrivilege	3392	svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 5812	3576	2026-08-10_b69ce7ff09aab4f9237ecd2ad2424996_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe	96
PID 5812 wrote to memory of 820	5812	cmd.exe	98
PID 3576 wrote to memory of 4756	3576	2026-08-10_b69ce7ff09aab4f9237ecd2ad2424996_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe	101
PID 4756 wrote to memory of 5948	4756	cmd.exe	103
PID 3576 wrote to memory of 4908	3576	2026-08-10_b69ce7ff09aab4f9237ecd2ad2424996_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe	104
PID 4908 wrote to memory of 3296	4908	cmd.exe	106
PID 3392 wrote to memory of 3764	3392	svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_b69ce7ff09aab4f9237ecd2ad2424996_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b69ce7ff09aab4f9237ecd2ad2424996_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABACCCACAACBCBAAAACCBCACBAABCBBAAAACBABCBBBCCABAABBCCABCBBBACACAAAABBCCACBCCCCACCACCBBBCAACAABCBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABACCCACAACBCBAAAACCBCACBAABCBBAAAACBABCBBBCCABAABBCCABCBBBACACAAAABBCCACBCCCCACCACCBBBCAACAABCBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBBAABBABBCACABBBAACAACCCAAABCCBCCBABAABABCABBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe" start= auto displayName= "UserDataSvc_BBCBBAABBABBCACABBBAACAACCCAAABCCBCCBABAABABCABBCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCBBAABBABBCACABBBAACAACCCAAABCCBCCBABAABABCABBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe" start= auto displayName= "UserDataSvc_BBCBBAABBABBCACABBBAACAACCCAAABCCBCCBABAABABCABBCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCBBAABBABBCACABBBAACAACCCAAABCCBCCBABAABABCABBCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCBBAABBABBCACABBBAACAACCCAAABCCBCCBABAABABCABBCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3764

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBABABCAAABCAAACACBACABBAABAACCBABACAAABCBCCCACAAABB.exe
1⤵
- Executes dropped EXE
PID:4984

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCCACCABBCABCBCBBABACACCACABBABAABCABBABCBACABBCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCCACCABBCABCBCBBABACACCACABBABAABCABBABCBACABBCBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fc507907fecc8581eab8e223e01c3b9eacbf01e32251093a5ac0f2282d3cd2c5
MD5 95bb3f959d599ee119e3072d60c83379
SHA1 af90c10438f30dbe2b311175434d6ab295e87e8a
SHA512 e266a6f5def131b1859cab51789934fbaf880e5ed458979fba1fc69e10ff8ecbeb64de5e3aa479ea64b48b49fc1a0c38bc5384664decc295b02c4b157b101120
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 345a089d1da653bf07188039f311af82d4465dbb16534bc3340509a7df1f7e66
MD5 4dc01946c07d61f9702996843c66fdf7
SHA1 f07036db92923a5b2ce0dd4b573fc1f7443ef392
SHA512 249d29861453458bb2564743afabccf19216d9bbee159ba03780309b454885efd995eea640ccbd5376588b9158e25d21704f4b678609d8f37f9ca8b9873edf04
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed39181f0ced53a57bb2f22fcfdc1dfc867838d3d9d85d5de95059bdebd06209
MD5 ee011a13873eb7489d2c537cef9c12b5
SHA1 df6c5f75280c994abfa8bc098409df6b18feb62d
SHA512 cf67e415c5cc456843e76195b73c53da6e75321169a433d23f2a5cf881f99eb3655cf1656d3fed6f02e6335c9cc1ea265f13d6902e97c2ecc60f409046d1ab88
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0d1d2c6ca0ef10c704f1de30a4a07524cb0ad1856eb17e4ab53672031d3dfd00
MD5 89f450c9818b8d284af7e1d345b1e8b0
SHA1 3947960c16cf3fd86fcd4fa9f6521a71af167a57
SHA512 50117cad312f8139897f7f8d4352f2817753d655b824a3987168210101770211c9d745597effd1103c6ca81b03e5dd41ce9a4d87abf7fc1fbf2facbe80f5faa2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1f2d8d06f5a67ebd7b767ffef54732ffdfede0fc56256672c1332917cfefef54
MD5 546e950eb8739267a1a7796f249b9ba8
SHA1 2d489bccd99559abd827e4b5033db67c94700126
SHA512 0211040b06d1eb47b369960aaab7f87c3c96a8d7456bed1f99991722ea5f3b3bc176154775621a436b63f445a0797aae752d5a642c1fa9086d41a549ee6fa39c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2ec6d021ed2288b805308e8898acadb04d3daa33a80e97d7dcfe2e886ecab642
MD5 d795c5033035640b4f56d5efd1577e6f
SHA1 7277879b1f82f7bc2a925683039430ed54c515ed
SHA512 c91186aba52354428d2e8c7a40e35ff793696dc15adb1d75991999c144fe573c9afa2a5afb904d9ef34d555e3c1031c0aa29400f1e412f36b94f4340f268401a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bb99042460bb0a40e0a4a096ad027a5f369d2e02b1fbd35d189dfacbede47378
MD5 3f5c370a87894ddd897f7b25fb4b4567
SHA1 17979725b96fcf05eb56ff1345fbd26f1f26d93d
SHA512 b74bc95589a33e1ecb4b1ad8fd5b318c667ec5ee155ae235a95de1a2d94849ab4b15a081bcc0f52248c750d376d8d73796cb734f5071ebbf027a7b4163d2b703
MD5 SHA1 SHA512

Submit Download

memory/3392-72-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/3392-51-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/3392-33-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/3576-60-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/3576-34-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/3576-0-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/3576-22-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/3576-11-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/3576-85-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/4984-87-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download