bc1ef4f4b4419fbbf12c0cfca194f600bf2725555e90eeac41ab09c5e48f2493

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_0fa0c563f223ab30b1f8a5a13ef79575_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 16.8MB
Sample260811-efbgracd27
SHA256 bc1ef4f4b4419fbbf12c0cfca194f600bf2725555e90eeac41ab09c5e48f2493
MD5 0fa0c563f223ab30b1f8a5a13ef79575
SHA1 f05fdd84a53ccad58960ee29f2e3557f4440e38c
SHA512 c10ae71a13d00ca9049b48bd7a702ad2c37a50a55429461f67cb8b0bb274e81e5572883a1f75ab9be63c6a6e35d40743739cbc1aed7ede86b8baacc0776e43b2
SSDEEP 196608:W7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou9:WahvQHrc8u3xXJ/f4uUWHU
TLSH
T1FB07AE17B35A85E6C06AD2B88A474212D7B67C440330A7DF26E5B7292F37BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024258-21.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024258-21.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024258-21.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4664	svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe
2452	svchost_BBBAAAAAACABABBAACAACABCBBACABCCACBBCCBCCCCCCACBACBCABA.exe
3864	svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAACABACCCCCBACBACCAACCACBAACBCCABCABBCABCCCABCACBABCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe"	2026-08-11_0fa0c563f223ab30b1f8a5a13ef79575_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBBCBBBCCACABAACAAAAABBAAACCAACBACCABABABBBCAACACBABCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBAAAAAACABABBAACAACABCBBACABCCACBBCCBCCCCCCACBACBCABA.exe"	svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3880	sc.exe
720	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2976	cmd.exe
4288	cmd.exe
4916	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBAAAAAACABABBAACAACABCBBACABCCACBBCCBCCCCCCACBACBCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_0fa0c563f223ab30b1f8a5a13ef79575_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4088	2026-08-11_0fa0c563f223ab30b1f8a5a13ef79575_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4088	2026-08-11_0fa0c563f223ab30b1f8a5a13ef79575_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4088	2026-08-11_0fa0c563f223ab30b1f8a5a13ef79575_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4088	2026-08-11_0fa0c563f223ab30b1f8a5a13ef79575_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4664	svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe
4664	svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe
4664	svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe
4664	svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4088	2026-08-11_0fa0c563f223ab30b1f8a5a13ef79575_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	4664	svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4068	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 2976	4088	2026-08-11_0fa0c563f223ab30b1f8a5a13ef79575_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	100
PID 2976 wrote to memory of 2088	2976	cmd.exe	102
PID 4664 wrote to memory of 4556	4664	svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe	103
PID 4556 wrote to memory of 3360	4556	notepad.exe	104
PID 4088 wrote to memory of 4288	4088	2026-08-11_0fa0c563f223ab30b1f8a5a13ef79575_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	106
PID 4288 wrote to memory of 3880	4288	cmd.exe	109
PID 4088 wrote to memory of 4916	4088	2026-08-11_0fa0c563f223ab30b1f8a5a13ef79575_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	110
PID 4916 wrote to memory of 720	4916	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-11_0fa0c563f223ab30b1f8a5a13ef79575_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_0fa0c563f223ab30b1f8a5a13ef79575_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABACBCBABBCCCABBAAACBACABCAACBBBBBBBCCBABCBBAACBABBBCAAABCCABACAABACACABBCBCBABCCACAACABBCCBCBBCCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABACBCBABBCCCABBAAACBACABCAACBBBBBBBCCBABCBBAACBABBBCAAABCCABACAABACACABBCBCBABCCACAACABBCCBCBBCCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABABACBCBAAABBBCACCBCCBAACBCCACCBBACBCCABBBBCBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe" start= auto displayName= "UserDataSvc_CABABACBCBAAABBBCACCBCCBAACBCCACCBBACBCCABBBBCBABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABABACBCBAAABBBCACCBCCBAACBCCACCBBACBCCABBBBCBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe" start= auto displayName= "UserDataSvc_CABABACBCBAAABBBCACCBCCBAACBCCACCBBACBCCABBBBCBABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABABACBCBAAABBBCACCBCCBAACBCCACCBBACBCCABBBBCBABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABABACBCBAAABBBCACCBCCBAACBCCACCBBACBCCABBBBCBABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3360

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4068

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAAACABABBAACAACABCBBACABCCACBBCCBCCCCCCACBACBCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAAACABABBAACAACABCBBACABCCACBBCCBCCCCCCACBACBCABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe
1⤵
- Executes dropped EXE
PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8919d6071a5f9a947d3bfc32c771f9ec70d31faa8291f1c3ee652e1c76a10f67
MD5 fb551597b85bae68293725d364d0bbb5
SHA1 4269c9699738e058047dfe6f3ae516f25cb9eab8
SHA512 a4814711d3efdf2733849aad16b1c373b753ccab68eddda0542d41435018b182fc8d4a568f234f618c1e550f417534fabc4ff0a2226a2e85e5dbb71ae1bb3a6c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5e6bcf531efe683075dbf5d1018dcc33b3e948f1a2acd21f91ada96e244d72d1
MD5 aee3366c00b0dbabd2822fda1af9f977
SHA1 b9ef637f2091a467d76053444ceaf577d64fae35
SHA512 02f690e4eda899fc3f4a1fb1f76a9b2e272c59a64fdfedcc6bb594559739e01f7e76c8c7406491a58f0988263fd23503b34b9512ee03ac736881e4d97d062a04
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cb1ae3b76e7a62bb6350da0da2db01c8114aad1341116d265a6365eb33c2e353
MD5 3fac18d5a84b8053e648fce246fa85bf
SHA1 6fe4fb4cfabf3329ec54485e64f38ec9443e6dca
SHA512 96c34899616528c5d817f763943a3b61eeac3c115aea177e7123fa3903d8e6ee0df780bc1a2db502dbfdcaa8624aefda63cf1d119b0b422acf2bb44c0b7ee0f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dc482641f475174942a274e4d2e1104c29c20415a7894fda231fefb661e1a0aa
MD5 2e00a628bdcd272e754531e1b3f7ff34
SHA1 969e85ad056447667c9f49cabbf61d4793b258b1
SHA512 46d1ece806873f80fe04d7d97b16d0f6d57590a2891034cf0b44657fd411a9252475033b29580f7d9960ce0db145fd6597d60b1554f7ddcff0d0746c783c139e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 200119fbfe6f16f140f8ab0be61db186474650e80164dc13aef1903a12e600ae
MD5 8dcb13ad8cae378ed3b6769f1634c2a4
SHA1 ef7290933d6b339b9bdfdf2ee78757292c33c3ac
SHA512 adb7c5c3dc5a9f54b87a3e5dc23f145a73c83d943b2fb3e942844d8b068a507e7ca3f7141306db88cc1719516e2d724dec6f421f9c71b1cae677f907fc4dddcf
MD5 SHA1 SHA512

Submit Download

svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACCACBBBBAACBBACCBACAAACCBCAABBABBACABBBCCBBCACABA.exe
Size 16.8MB
SHA256 bc1ef4f4b4419fbbf12c0cfca194f600bf2725555e90eeac41ab09c5e48f2493
MD5 0fa0c563f223ab30b1f8a5a13ef79575
SHA1 f05fdd84a53ccad58960ee29f2e3557f4440e38c
SHA512 c10ae71a13d00ca9049b48bd7a702ad2c37a50a55429461f67cb8b0bb274e81e5572883a1f75ab9be63c6a6e35d40743739cbc1aed7ede86b8baacc0776e43b2
SSDEEP 196608:W7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou9:WahvQHrc8u3xXJ/f4uUWHU
TLSH
T1FB07AE17B35A85E6C06AD2B88A474212D7B67C440330A7DF26E5B7292F37BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4088-0-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/4088-7-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/4556-60-0x00000000055E0000-0x00000000055E1000-memory.dmp

Download

memory/4664-27-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/4664-37-0x0000000000690000-0x00000000006B1000-memory.dmp

Download