a177f846eb51f699ef59fa588d9d42ad82719a48cda0f84cb64325a2dab7afd9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_0468f6cf18c446a75461b6f3e3594510_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 14.9MB
Sample260813-cd19aaxzhy
SHA256 a177f846eb51f699ef59fa588d9d42ad82719a48cda0f84cb64325a2dab7afd9
MD5 0468f6cf18c446a75461b6f3e3594510
SHA1 eae1c8a1562ee2a9b7fa70cc1761b7b173b55612
SHA512 a2274c02ba1a2d3d772156fcde36438433eff61d518a0b9ac6282d2d577b5611c1290dfa0c9d4d41c3c3da80fd67dcdcc0b1137b7246050a70a3fc05af941390
SSDEEP 196608:Y5q7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToun:Y5qahvQHrc8u3xXJ/f4uUWH2
TLSH
T1D1F69E17B35A81E6C02AE2B88A474212E7B67C440334A7DF12D5B7692F77BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024406-22.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024406-22.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024406-22.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5016	svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe
2816	svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe
2296	svchost_BBAACCBCBCACCACBAAAABCAAABCABCCCACBBBCAABBACBBAABBCACAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CAACCABCCBCACCBCBBCCACBCBCCBACCABBCAACBCBCCBBACACCCBCCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe"	2026-08-12_0468f6cf18c446a75461b6f3e3594510_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACBACCBCABBCBAACCABABBBCCCBBABCCCAACCAACBABACACCBBABBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAACCBCBCACCACBAAAABCAAABCABCCCACBBBCAABBACBBAABBCACAB.exe"	svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2800	sc.exe
4392	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
644	cmd.exe
4820	cmd.exe
1120	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_0468f6cf18c446a75461b6f3e3594510_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAACCBCBCACCACBAAAABCAAABCABCCCACBBBCAABBACBBAABBCACAB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2064	2026-08-12_0468f6cf18c446a75461b6f3e3594510_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2064	2026-08-12_0468f6cf18c446a75461b6f3e3594510_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2064	2026-08-12_0468f6cf18c446a75461b6f3e3594510_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2064	2026-08-12_0468f6cf18c446a75461b6f3e3594510_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5016	svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe
5016	svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe
5016	svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe
5016	svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	2026-08-12_0468f6cf18c446a75461b6f3e3594510_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	5016	svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4416	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 644	2064	2026-08-12_0468f6cf18c446a75461b6f3e3594510_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	100
PID 644 wrote to memory of 4684	644	cmd.exe	102
PID 5016 wrote to memory of 2308	5016	svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe	104
PID 2064 wrote to memory of 4820	2064	2026-08-12_0468f6cf18c446a75461b6f3e3594510_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	105
PID 4820 wrote to memory of 2800	4820	cmd.exe	107
PID 2064 wrote to memory of 1120	2064	2026-08-12_0468f6cf18c446a75461b6f3e3594510_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	108
PID 1120 wrote to memory of 4392	1120	cmd.exe	110
PID 2308 wrote to memory of 1396	2308	notepad.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-12_0468f6cf18c446a75461b6f3e3594510_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_0468f6cf18c446a75461b6f3e3594510_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCBCBBCCBCCCCAACBBBACCACAABAACCBCCBABBBBACABAAAABABBABABBBCBBACABACBCBBAABCBABAAABCBCBCBBBAAAAAAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCBCBBCCBCCCCAACBBBACCACAABAACCBCCBABBBBACABAAAABABBABABBBCBBACABACBCBBAABCBABAAABCBCBCBBBAAAAAAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBABBBCABABBABABCBACACCBBABBBCCBBBBCCBBACBBCCACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe" start= auto displayName= "UserDataSvc_BBBABBBCABABBABABCBACACCBBABBBCCBBBBCCBBACBBCCACBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBABBBCABABBABABCBACACCBBABBBCCBBBBCCBBACBBCCACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe" start= auto displayName= "UserDataSvc_BBBABBBCABABBABABCBACACCBBABBBCCBBBBCCBBACBBCCACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBABBBCABABBABABCBACACCBBABBBCCBBBBCCBBACBBCCACBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBABBBCABABBABABCBACACCBBABBBCCBBBBCCBBACBBCCACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe
1⤵
- Executes dropped EXE
PID:2816

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCBCBCACCACBAAAABCAAABCABCCCACBBBCAABBACBBAABBCACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCBCBCACCACBAAAABCAAABCABCCCACBBBCAABBACBBAABBCACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 da778f633186ab807bdb5e56cdbd0cef151f3e03b50e2e592fed77f132228ee8
MD5 4017b028efc64bbbb3d72f04224d2854
SHA1 a051fda231a37f14fccd8690c3a24af45b1cbe4a
SHA512 dab292aa0d6de54717eebb00fbe59e5ef51fb89b34bcf2fc37a8d96d971a61d3b842f7d61282e7e7676583c5324b477387119ecb2a3242481387acbb98f58f26
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9bbefd11618ed87183e22ef43e015823d33ae9a51405bf37055ede0c50c72f89
MD5 7b6a6e4374a575f2c77fb52b7b07d454
SHA1 fe248e5e4663cfc98a1e0f569d046554ce9b2c21
SHA512 5b48a21b9319d0b30ba58d41061147e6c59d77faa173b9f3a08fd372ca81505b08ec35a5fa32fa2cb75312ba6112f5c0ec9185e4ec28c911d467fbbea9bd4173
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d278c574822f63e20854437a690beef36590e8a5914595296f3aa1e089891d8d
MD5 01609f653a7ea28a077abf82ee7dd5a2
SHA1 83205b21a0f6f4fce6f715b5c00cbc66cb61dbdf
SHA512 71d61cf747a1c39553003ede0a1f96d88d8156763dd10567a9fa8a9fa793f1cd8da5ff5541e62ee11d4cc60024eaf46a2c681a3914d9a3028841a605f9cee5e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ed1e95d327e5eec9ea8f4a97e9e3eaaf166b98dfd4a7a18e392a95d68324ae5d
MD5 aa622cf6b1165e0f38ee42ec3832ce85
SHA1 e8ec7c3754f8a16714d89f3fa27c1d4ca7038037
SHA512 41f970a7209fa5072a158d0abb6862b32eca97b71e7243b30b762b9d5a594c4010ee337c70b01abd81d8bdba0bd40219c43d8887609dab999e2591ab1c7a8ecd
MD5 SHA1 SHA512

Submit Download

svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBABBBBCBCCBCBBBBACCACABABBBABACCCBCBACBCBCBACBCBAC.exe
Size 14.9MB
SHA256 a177f846eb51f699ef59fa588d9d42ad82719a48cda0f84cb64325a2dab7afd9
MD5 0468f6cf18c446a75461b6f3e3594510
SHA1 eae1c8a1562ee2a9b7fa70cc1761b7b173b55612
SHA512 a2274c02ba1a2d3d772156fcde36438433eff61d518a0b9ac6282d2d577b5611c1290dfa0c9d4d41c3c3da80fd67dcdcc0b1137b7246050a70a3fc05af941390
SSDEEP 196608:Y5q7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToun:Y5qahvQHrc8u3xXJ/f4uUWH2
TLSH
T1D1F69E17B35A81E6C02AE2B88A474212E7B67C440334A7DF12D5B7692F77BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2064-0-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/2064-7-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/2308-67-0x0000000003210000-0x0000000003211000-memory.dmp

Download

memory/5016-27-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/5016-40-0x0000000000550000-0x0000000000571000-memory.dmp

Download