196dd3385b6a5467ca764d8d16e9ec264a6a95612923dc9315364c2691e3f002

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_33c2d181ac6dd12e4f7bdb7f7ebb9ea3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 15.2MB
Sample260811-d2mapsfk6y
SHA256 196dd3385b6a5467ca764d8d16e9ec264a6a95612923dc9315364c2691e3f002
MD5 33c2d181ac6dd12e4f7bdb7f7ebb9ea3
SHA1 e190f79768f1831f9020bc6bc8c34378afe317b0
SHA512 586ffdadbeea03ef5caeb3768c4f4acf64dd3d8f25adf4d3d4a501e553cea8e98a7998ab9ee9d50d432d1ec6a9a3c5a23296b3e59ddf3a008fbadd769d7dfb13
SSDEEP 196608:x7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToux:xahvQHrc8u3xXJ/f4uUWHe
TLSH
T12DF69D17B35681E6C02AE2B88A474223D7B9BC440334A7DF16D5B7692F37BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c650-20.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c650-20.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c650-20.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
5536	svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCACAAABBABABBBCCACACAAABBBABCBACCBAABBBCAABCCAABAAABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe"	2026-08-11_33c2d181ac6dd12e4f7bdb7f7ebb9ea3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBCACCCCBBABBCAACBBCAACAAACCAACABBBBBABCCCCABACACBBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBABABBCBCCBCCACCABCCACCCBCBCBACBBBAAABBBABABCBBCCABAB.exe"	svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5736	sc.exe
1728	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4700	cmd.exe
5712	cmd.exe
6104	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_33c2d181ac6dd12e4f7bdb7f7ebb9ea3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1152	2026-08-11_33c2d181ac6dd12e4f7bdb7f7ebb9ea3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1152	2026-08-11_33c2d181ac6dd12e4f7bdb7f7ebb9ea3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1152	2026-08-11_33c2d181ac6dd12e4f7bdb7f7ebb9ea3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1152	2026-08-11_33c2d181ac6dd12e4f7bdb7f7ebb9ea3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5536	svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe
5536	svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe
5536	svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe
5536	svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	2026-08-11_33c2d181ac6dd12e4f7bdb7f7ebb9ea3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	5536	svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 4700	1152	2026-08-11_33c2d181ac6dd12e4f7bdb7f7ebb9ea3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	91
PID 4700 wrote to memory of 6044	4700	cmd.exe	93
PID 5536 wrote to memory of 3772	5536	svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe	94
PID 1152 wrote to memory of 5712	1152	2026-08-11_33c2d181ac6dd12e4f7bdb7f7ebb9ea3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	95
PID 5712 wrote to memory of 1728	5712	cmd.exe	97
PID 1152 wrote to memory of 6104	1152	2026-08-11_33c2d181ac6dd12e4f7bdb7f7ebb9ea3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 6104 wrote to memory of 5736	6104	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-11_33c2d181ac6dd12e4f7bdb7f7ebb9ea3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_33c2d181ac6dd12e4f7bdb7f7ebb9ea3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABCBAABAACCBCACABAAACBACCACAACBCAACCCCACAAAACCAABACCBCCBABCCAABBBBCCABAAABABBBBCABCCACACACBCABAABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABCBAABAACCBCACABAAACBACCACAACBCAACCCCACAAAACCAABACCBCCBABCCAABBBBCCABAAABABBBBCABCCACACACBCABAABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBACCAACABCACCCABBBAACCAACACCAABACBBACACAABCBCAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe" start= auto displayName= "UserDataSvc_BBBACCAACABCACCCABBBAACCAACACCAABACBBACACAABCBCAAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBACCAACABCACCCABBBAACCAACACCAABACBBACACAABCBCAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe" start= auto displayName= "UserDataSvc_BBBACCAACABCACCCABBBAACCAACACCAABACBBACACAABCBCAAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBACCAACABCACCCABBBAACCAACACCAABACBBACACAABCBCAAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBACCAACABCACCCABBBAACCAACACCAABACBBACACAABCBCAAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5736

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3772

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe
1⤵
PID:5040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABABBCBCCBCCACCABCCACCCBCBCBACBBBAAABBBABABCBBCCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABABBCBCCBCCACCABCCACCCBCBCBACBBBAAABBBABABCBBCCABAB.exe
1⤵
PID:3688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c0dcd41c8755c8a9c41a599182b703f5ba50a46950243956feb8c10ba42069d5
MD5 59c910901e727dd075b367f2bd22f177
SHA1 f50903385950eca0b83f55195d4996e1299e007c
SHA512 b09b11367c2e249b60a61f3a58fd373239ac7126de7eb8aac20bb8a012a2c1d63798042b939d3d6fd12eb8236705147bb975919e0edd89301ae39c8ce6d9cb65
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d1d137751807f58d7ac8c72fc67dff5610d133d049cf72699423e228e13227c5
MD5 d448866f12a8f7f82ead785d9d2ba666
SHA1 ebe948827d358b8f5326027899f2685b66c3b034
SHA512 991da6a28b0e419edbec0421e51c7dfe74a9d66250207257477da8c86c6abf470b2b9ca273bdece00b2ac5bbe196ffbd37d780ab2942acfe64bc027bd5633e4d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2f313aab0bfeddef3640fe368ce65c2f357f7b38702087530745c1806cc5fe5f
MD5 5fcb08e5025198ca8805bfa1d76cfa1b
SHA1 28e9ec05f867a26b078fdfce977b81fedd252e7e
SHA512 7fc319b646392f99a20282ba0e66878d19c6384be125a889e8af3ede858ca1fa4bce3874f831acde256c5ee99388edb60128603ac22221a2d4e1f41ddbd9a0a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b7b62d13a5af30efdb9f4b321c8fe4ac50ef0658dcefcb7ef10421187e3c99c5
MD5 75117abcfeb677c1aa642a0bc94b1867
SHA1 468e5d70234b5e1ccabfaba8c553cefe62834b78
SHA512 a8c513763d80e813f7febf5c7131f88401ed371df61600ff813135597433a796426da72bdc9d4633f38f90eb4deb297b4108cffd126d2485f77dc44002c73cd2
MD5 SHA1 SHA512

Submit Download

svchost_ABBABABBCBCCBCCACCABCCACCCBCBCBACBBBAAABBBABABCBBCCABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABABBCBCCBCCACCABCCACCCBCBCBACBBBAAABBBABABCBBCCABAB.exe
Size 13.6MB
SHA256 95431e346ae05d383527a911cf96fd63b4df95d5aaf095b64bf6a4d50ee08b65
MD5 33ef0c26dc204cc4388ccbd600f06d48
SHA1 011d6ffd7d37778a13c03c0afa126e9938044d6b
SHA512 93e32b72779721028c11b3a71d01389cb61bc40e93feda306ec98d32530762b53b24ed5276727b819bf507419777c34cc3fb9b7f516629795b6b013da4227259
SSDEEP 98304:x7Upmya6iSNNEuy4v/YtfKoNewC8rc8u3xP33zkEszWiC/f35DKJU15xP7GqxQWR:x7APhNNECwHrc8u3x3AEcq/fByuKlWR
TLSH
T155E69D17B25A81E6C02AE2F88A474223D7B57C440324B7DB26E5B7692F37BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACACABCCBAAACBBBCCBACBBACCACCABBBCBCCABCCACBBCBABBB.exe
Size 15.2MB
SHA256 196dd3385b6a5467ca764d8d16e9ec264a6a95612923dc9315364c2691e3f002
MD5 33c2d181ac6dd12e4f7bdb7f7ebb9ea3
SHA1 e190f79768f1831f9020bc6bc8c34378afe317b0
SHA512 586ffdadbeea03ef5caeb3768c4f4acf64dd3d8f25adf4d3d4a501e553cea8e98a7998ab9ee9d50d432d1ec6a9a3c5a23296b3e59ddf3a008fbadd769d7dfb13
SSDEEP 196608:x7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToux:xahvQHrc8u3xXJ/f4uUWHe
TLSH
T12DF69D17B35681E6C02AE2B88A474223D7B9BC440334A7DF16D5B7692F37BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-0-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/1152-8-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/5536-24-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/5536-34-0x0000000000210000-0x0000000000231000-memory.dmp

Download