4184da2b6477e7ad2b7c2d2ec290a672c995ef64e2f61d8d5eea1da02236f073

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_3960abdf2ce10624a67163cb421ae13e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 16.0MB
Sample260814-b7c8wasthx
SHA256 4184da2b6477e7ad2b7c2d2ec290a672c995ef64e2f61d8d5eea1da02236f073
MD5 3960abdf2ce10624a67163cb421ae13e
SHA1 003ce4bb2724bd02f371a7d72ebd3e00da368051
SHA512 21d2a63e34994026845e03e3b5adf9c4ac8a0b8778edf33d4529d976156105a188e6657db2e028f0db027d517173c7fb1e9026cbeee0b92cf1abafc1b32f2b76
SSDEEP 196608:K7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou+:KahvQHrc8u3xXJ/f4uUWHf
TLSH
T12107AE17B34681E6C02AD2B88A474327D7B5BC440331A7DB26D5B76A2F37BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5b7-20.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5b7-20.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5b7-20.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4432	svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe
5376	svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe
2080	svchost_BABBACBBACCABBACAAABCCCACAAACCBBABCAACAABBBCAACBBABBBBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBAACABBAAACAABBBAACAAABABCBCCCBCABAACABBBCCBACBCBAABCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBACBBACCABBACAAABCCCACAAACCBBABCAACAABBBCAACBBABBBBC.exe"	svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACBBBBCABABBACCABABCCBAABBABABBCBACACBCBBCABAABBBBAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe"	2026-08-14_3960abdf2ce10624a67163cb421ae13e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3756	sc.exe
2412	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1792	cmd.exe
2040	cmd.exe
1776	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBACBBACCABBACAAABCCCACAAACCBBABCAACAABBBCAACBBABBBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_3960abdf2ce10624a67163cb421ae13e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1860	2026-08-14_3960abdf2ce10624a67163cb421ae13e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1860	2026-08-14_3960abdf2ce10624a67163cb421ae13e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1860	2026-08-14_3960abdf2ce10624a67163cb421ae13e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1860	2026-08-14_3960abdf2ce10624a67163cb421ae13e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4432	svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe
4432	svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe
4432	svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe
4432	svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1860	2026-08-14_3960abdf2ce10624a67163cb421ae13e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	4432	svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1792	1860	2026-08-14_3960abdf2ce10624a67163cb421ae13e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 1792 wrote to memory of 3752	1792	cmd.exe	94
PID 1860 wrote to memory of 2040	1860	2026-08-14_3960abdf2ce10624a67163cb421ae13e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	95
PID 2040 wrote to memory of 3756	2040	cmd.exe	97
PID 1860 wrote to memory of 1776	1860	2026-08-14_3960abdf2ce10624a67163cb421ae13e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 1776 wrote to memory of 2412	1776	cmd.exe	100
PID 4432 wrote to memory of 5352	4432	svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_3960abdf2ce10624a67163cb421ae13e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_3960abdf2ce10624a67163cb421ae13e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCAACAAACACCCACBAAACCBABBACCCBACCBBBCBCCCCABBABAAABABBCCACABBBCCBBBBCABBBCACBACCABCBCCACBCCCAAACAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCAACAAACACCCACBAAACCBABBACCCBACCBBBCBCCCCABBABAAABABBCCACABBBCCBBBBCABBBCACBACCABCBCCACBCCCAAACAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBBACACACCACBAACACCBACBBBACBAACABAABAABBCACCBABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe" start= auto displayName= "UserDataSvc_BCCBBACACACCACBAACACCBACBBBACBAACABAABAABBCACCBABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBBACACACCACBAACACCBACBBBACBAACABAABAABBCACCBABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe" start= auto displayName= "UserDataSvc_BCCBBACACACCACBAACACCBACBBBACBAACABAABAABBCACCBABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBBACACACCACBAACACCBACBBBACBAACABAABAABBCACCBABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBBACACACCACBAACACCBACBBBACBAACABAABAABBCACCBABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5352

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe
1⤵
- Executes dropped EXE
PID:5376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACBBACCABBACAAABCCCACAAACCBBABCAACAABBBCAACBBABBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACBBACCABBACAAABCCCACAAACCBBABCAACAABBBCAACBBABBBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5744b512e2f7ba6e61d3572e5f9e5210f9a04ca59578074393277ee215516c99
MD5 2cf51355175c79f79b53e75cbd618767
SHA1 5b3d3da6d65e07b54113653315f10cde64e76b22
SHA512 ae881f12c8dcf9e9a1428feef1b2021b1e03b49e856a762436f2545b6dec468f23b35dc4c6f6288bc7a44f232d2949745d1a217b8a66ad347ee25688122e2f3c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b064727180c8ad1556eb217b22b9e5adb1714857457065bbb7111b38e61d70e5
MD5 3876669111b8483a55a46eb9f9f30520
SHA1 4f816789a46ee9c2baacf45845ab28b88227d7d0
SHA512 d8f64cd11fbf75c89352043e05547cc212c69c93835434852547740208e84b7278bc310d91024aa54c3821635a49c9e8cdb410356402f43269b899bce85df8ab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3edd85dde07cbb3113e81445afa17a48a3d03d834797c98c4cbc19804788a2b7
MD5 ee1e9a71a187240239558e07d6498632
SHA1 a37516e2c5a239800048078a058514bd4006c000
SHA512 af4c1fe9563276e66fb860f798284f43ef171fca6f70a72d11f7428babd386f9fbe9c693ef19fca9fb12853d450fb76a8dcc76350dda0287ec8bcba40cf10c63
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 29cf6a8187c20a29d33b5b7bd57cf7d01e186cd96d4f6ef9751d774f60f580f8
MD5 5249d47fb2a8fa84a9b4be22c5616e47
SHA1 39b6bdb814ea0629f002a553813b8bcfaf17bdb7
SHA512 21acdb798acf1449ca15261e99448675589efaf3e89b827ae378e03016705a3bd2434d74287a7b98220c9725a1235d2738b3438c66b02cd6100a21442a1a5a3c
MD5 SHA1 SHA512

Submit Download

svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAAACABCABCAAACCBBAABAAACCCAAACCBBAAABBABACBAACABBA.exe
Size 16.0MB
SHA256 4184da2b6477e7ad2b7c2d2ec290a672c995ef64e2f61d8d5eea1da02236f073
MD5 3960abdf2ce10624a67163cb421ae13e
SHA1 003ce4bb2724bd02f371a7d72ebd3e00da368051
SHA512 21d2a63e34994026845e03e3b5adf9c4ac8a0b8778edf33d4529d976156105a188e6657db2e028f0db027d517173c7fb1e9026cbeee0b92cf1abafc1b32f2b76
SSDEEP 196608:K7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou+:KahvQHrc8u3xXJ/f4uUWHf
TLSH
T12107AE17B34681E6C02AD2B88A474327D7B5BC440331A7DB26D5B76A2F37BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1860-0-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/1860-8-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/4432-24-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/4432-37-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download