6d0e31fbe07b24f20e862b1cfd5b9b56e62f62defd0be42575c1819cefe297ec

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_abe5b17b8e3dd5c0591cbbed97f1ec9d_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 15.1MB
Sample260810-erhefa1bqg
SHA256 6d0e31fbe07b24f20e862b1cfd5b9b56e62f62defd0be42575c1819cefe297ec
MD5 abe5b17b8e3dd5c0591cbbed97f1ec9d
SHA1 7267d930e2f4b6c21b564bf06d0b720bef0a0efd
SHA512 ab2c7a61b374a4a1ac15aabf6097640c3fa4da4723d45fdddcd2266b8bf8ce3c7361b1c578386aed7079ed045efb3e24bc18b493c78e05a2c42df0ed6e188c60
SSDEEP 196608:p7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouC:pahvQHrc8u3xXJ/f4uUWHz
TLSH
T19AF69E17B35A81E6C02AE2B88A474323D7B67C440330A7DB16D5B7692F77BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5da-20.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5da-20.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5da-20.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
1968	svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe
5824	svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACBCCAAABCAACCABBBBCBAAAABCBCBBBCBAACCACACCCBCABCAABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe"	2026-08-10_abe5b17b8e3dd5c0591cbbed97f1ec9d_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBABBBCAACBBCBABCABACABBCACBCAAAAACBBACAACCAABACBBAAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCCCBBCAABBCABCABCCBBACCCAABBBAACBACCABBBBCACACBACAAA.exe"	svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2620	sc.exe
1956	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4992	cmd.exe
1532	cmd.exe
5672	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_abe5b17b8e3dd5c0591cbbed97f1ec9d_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4304	2026-08-10_abe5b17b8e3dd5c0591cbbed97f1ec9d_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4304	2026-08-10_abe5b17b8e3dd5c0591cbbed97f1ec9d_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4304	2026-08-10_abe5b17b8e3dd5c0591cbbed97f1ec9d_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4304	2026-08-10_abe5b17b8e3dd5c0591cbbed97f1ec9d_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1968	svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe
1968	svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe
1968	svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe
1968	svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4304	2026-08-10_abe5b17b8e3dd5c0591cbbed97f1ec9d_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	1968	svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 4992	4304	2026-08-10_abe5b17b8e3dd5c0591cbbed97f1ec9d_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 4992 wrote to memory of 1980	4992	cmd.exe	94
PID 4304 wrote to memory of 1532	4304	2026-08-10_abe5b17b8e3dd5c0591cbbed97f1ec9d_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	95
PID 1532 wrote to memory of 2620	1532	cmd.exe	97
PID 4304 wrote to memory of 5672	4304	2026-08-10_abe5b17b8e3dd5c0591cbbed97f1ec9d_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 5672 wrote to memory of 1956	5672	cmd.exe	100
PID 1968 wrote to memory of 2552	1968	svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_abe5b17b8e3dd5c0591cbbed97f1ec9d_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_abe5b17b8e3dd5c0591cbbed97f1ec9d_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACCACCBCABCCABABAABAABAACCBBAAABBCACCCBAAAAAACBBAAABCABBBCACCCABAABBBBBAABBCACBACBACBACBCABAACACACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACCACCBCABCCABABAABAABAACCBBAAABBCACCCBAAAAAACBBAAABCABBBCACCCABAABBBBBAABBCACBACBACBACBCABAACACACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCBABBCABACACABCBBBCBABBBAAACCBBACBBCBBACBCBACCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe" start= auto displayName= "UserDataSvc_BCBCBABBCABACACABCBBBCBABBBAAACCBBACBBCBBACBCBACCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCBABBCABACACABCBBBCBABBBAAACCBBACBBCBBACBCBACCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe" start= auto displayName= "UserDataSvc_BCBCBABBCABACACABCBBBCBABBBAAACCBBACBBCBBACBCBACCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCBABBCABACACABCBBBCBABBBAAACCBBACBBCBBACBCBACCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCBABBCABACACABCBBBCBABBBAAACCBBACBBCBBACBCBACCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe
1⤵
- Executes dropped EXE
PID:5824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2ffc61951c2578601d21d2269f7321af6a9e6b9316d4d0fb19ed90de864758bf
MD5 11e168bc333f29fc1922aafbb935569b
SHA1 2d2c8f834c1bf37d2c1418fa8049044fb403f04b
SHA512 49cc23dab42de46c0f471f3d741505f200a097b595dfd009b5115cbcc620db56170cb09e80ee181ff7b6b50094e372ba56bb0a65ace5638a15137df6e336e289
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ebeb5261ce5722102dd2d8596c07c96f3b8847d8a1558eed40e15944399dd2b5
MD5 c2839a21d2be2b40426582693ce20ed0
SHA1 d2e4e847f8c4fb7d30a8a103390539b0e6baed2e
SHA512 bf07fa0e340f6391c78038dd9715c6817f7c6c829ef16da835ac443a744cc16444cd904585b2b5b30daf0c3ec68c9799c1402cfb4b589bb7c9e35c312dc06590
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0159afae9608752d58491faf53a40200d2c204b30590e85e80847f0a97986589
MD5 50fd650105018993f31b9869ca6bd99d
SHA1 a2253cc9889895e8c5232a94a224f606e11b36a3
SHA512 79d92ee06241e6a0c58e874b9d00d10a0fea68c2114bca581f597b986d86e579990fdcecda145feadc168f338d23086f4fc16500d045f1923f34157492983046
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0db3907b91864e25e934362e3ce5be68edab35914e85735109a153fa9a2b5968
MD5 00269165ec5cf5e01cc99666fe64b330
SHA1 ac23144868f32acea5dcde60b0febe2548ca78db
SHA512 ef738bbcf56f6a751f3e7a525529e00f2c66c15d7e8e7234550dcc404ecc7d64bea02cc5fd79799640d39eee0d2b223186504dab005fa5da00e9df004f9bc083
MD5 SHA1 SHA512

Submit Download

svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABBBBCBCCCBBCBBCCCCACCCCCAABCCAAAAACCCAABAACCABAAAA.exe
Size 15.1MB
SHA256 6d0e31fbe07b24f20e862b1cfd5b9b56e62f62defd0be42575c1819cefe297ec
MD5 abe5b17b8e3dd5c0591cbbed97f1ec9d
SHA1 7267d930e2f4b6c21b564bf06d0b720bef0a0efd
SHA512 ab2c7a61b374a4a1ac15aabf6097640c3fa4da4723d45fdddcd2266b8bf8ce3c7361b1c578386aed7079ed045efb3e24bc18b493c78e05a2c42df0ed6e188c60
SSDEEP 196608:p7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouC:pahvQHrc8u3xXJ/f4uUWHz
TLSH
T19AF69E17B35A81E6C02AE2B88A474323D7B67C440330A7DB16D5B7692F77BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1968-24-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/1968-37-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/4304-0-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4304-8-0x0000000000410000-0x0000000000431000-memory.dmp

Download