b5cdf0cccd034467548e5bc532fb139dfd0bbd8239d3fe4abf6dac90a2937d5b

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_4f82b30e3b00bb5aa6ea3b8845aeee0e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 14.7MB
Sample260814-e4m6fsvvdx
SHA256 b5cdf0cccd034467548e5bc532fb139dfd0bbd8239d3fe4abf6dac90a2937d5b
MD5 4f82b30e3b00bb5aa6ea3b8845aeee0e
SHA1 4d0a4827e8cffea4b3ab6ac7537de8bf5024180d
SHA512 2c0b36cf7c4ef06a2e92cdb62d71c24c44e7d04e9d2848b71d984ec75be9519086912f427a01993c4726fe692d2c1e1352f8897f47fdfffac13593aff4dc2e78
SSDEEP 196608:BLZZ7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToue:PZahvQHrc8u3xXJ/f4uUWHb
TLSH
T164F69E13B35681E6C02AE2B88A474212E7B9BC440334B7DB16E5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5c5-19.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5c5-19.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5c5-19.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2456	svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe
4424	svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe
2992	svchost_BCCCBBBBCCACCBBABBABBCACAACBCBCABAABCBCBAACCAAABCBBBCCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAABAAABAABCBBBCBCCCABAABBBABACACABBCBAABBBBBAACAACABCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe"	2026-08-14_4f82b30e3b00bb5aa6ea3b8845aeee0e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBBBBACABACBCBCCBCCBABCACBCAABBCACBACCACBCBBABBBBBCCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCBBBBCCACCBBABBABBCACAACBCBCABAABCBCBAACCAAABCBBBCCA.exe"	svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1068	sc.exe
948	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5932	cmd.exe
3676	cmd.exe
860	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_4f82b30e3b00bb5aa6ea3b8845aeee0e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCBBBBCCACCBBABBABBCACAACBCBCABAABCBCBAACCAAABCBBBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5408	2026-08-14_4f82b30e3b00bb5aa6ea3b8845aeee0e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5408	2026-08-14_4f82b30e3b00bb5aa6ea3b8845aeee0e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5408	2026-08-14_4f82b30e3b00bb5aa6ea3b8845aeee0e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5408	2026-08-14_4f82b30e3b00bb5aa6ea3b8845aeee0e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2456	svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe
2456	svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe
2456	svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe
2456	svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5408	2026-08-14_4f82b30e3b00bb5aa6ea3b8845aeee0e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	2456	svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5408 wrote to memory of 5932	5408	2026-08-14_4f82b30e3b00bb5aa6ea3b8845aeee0e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 5932 wrote to memory of 5460	5932	cmd.exe	94
PID 2456 wrote to memory of 1292	2456	svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe	95
PID 5408 wrote to memory of 3676	5408	2026-08-14_4f82b30e3b00bb5aa6ea3b8845aeee0e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	96
PID 3676 wrote to memory of 1068	3676	cmd.exe	98
PID 5408 wrote to memory of 860	5408	2026-08-14_4f82b30e3b00bb5aa6ea3b8845aeee0e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	99
PID 860 wrote to memory of 948	860	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-14_4f82b30e3b00bb5aa6ea3b8845aeee0e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_4f82b30e3b00bb5aa6ea3b8845aeee0e_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACBACCCBBCAABBCCCCCBABBABACBBBBBCCABBAABCBACBCBCAAAAABACAAABCBACABAACBCBABACBBBABCABBCABBBCBBCCCCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACBACCCBBCAABBCCCCCBABBABACBBBBBCCABBAABCBACBCBCAAAAABACAAABCBACABAACBCBABACBBBABCABBCABBBCBBCCCCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACBAABCCBBBABBCCCBABBACBAAACCBACBCBBCCCCCCAABCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe" start= auto displayName= "UserDataSvc_CCACBAABCCBBBABBCCCBABBACBAAACCBACBCBBCCCCCCAABCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACBAABCCBBBABBCCCBABBACBAAACCBACBCBBCCCCCCAABCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe" start= auto displayName= "UserDataSvc_CCACBAABCCBBBABBCCCBABBACBAAACCBACBCBBCCCCCCAABCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACBAABCCBBBABBCCCBABBACBAAACCBACBCBBCCCCCCAABCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACBAABCCBBBABBCCCBABBACBAAACCBACBCBBCCCCCCAABCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1292

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe
1⤵
- Executes dropped EXE
PID:4424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBBBCCACCBBABBABBCACAACBCBCABAABCBCBAACCAAABCBBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBBBCCACCBBABBABBCACAACBCBCABAABCBCBAACCAAABCBBBCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2e7ca431d479586cc5fdf81034042d5dee9f9914b975f7f1dd5ef5afdddeb654
MD5 b8b7c4057b2dff9172f0144ee3c299b6
SHA1 e2e9ca5970ec564452ada63a1a6d2dba7c1a35f3
SHA512 da740549cfed853b6f570378f2e8a2ee446cbd7adee3e14f06ad1af59efe4d21714892c3b028232df8bb36542013cac68c30cc4646fb6ed39e5c6b98ea82f4d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6095d130fdeaba9b1f2ef3416a07cfa84068ea90db440ce9958ab40227e47eda
MD5 b0fa2289e72cb1114ed9a08a3da115f5
SHA1 01ed61958baab76618e4585fcc92e6731606dc46
SHA512 589fb78581f20e8252fe5ac9743cc043d1b1fbc882b499695991bdb3c757776e17dd944f392a5fa5da404fce5ab63c1f5362ee13a2935c2e6efa705b903875f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 17bc2c8e515c931619181bc5d21381221cbae079d69da8e29d07bc969e574ae9
MD5 388ab3cbb00a0bf0a7713103c6dfc302
SHA1 a60f881849e6f159f5554768aee7d1dddddb2a20
SHA512 812890d4e26fc4908ce52dae5d31ae3497210de612f4069a5539be18a5b62441d5f86550fb5475711c4ea5bbf8b0ad5d8907049ae5c8d5d79bf90b9586fb9ab0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 04da336aab0ed88ead2bfc02c45f7ff8164ed4d2e94c0e68782d1716e1ff6477
MD5 e294cfbc7e66e297a28f11d92696d1b8
SHA1 70f9dbd4aa97c101ec3c99815ab5c5ccf359c4f2
SHA512 d15e7cf67ef2529c3ba9667f0c75b1fb0c2bd3488e41b16a157c0d919afb9ab3db3ac2dc181a80b061ce830f0dd953ad5aeb107f94f861f86e9f4a6766dfd2ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 33c4812e3d5fa25ec400014c11ee0cadbca5e0511d7be05e93322b6792739a74
MD5 3c6fc1e1aa11e0bd3bb5b296d8e1b480
SHA1 9077f3b60a431492e3556b7ca62396371cd85b79
SHA512 64dade44fd966f4f4488ffee913ee9bcfd45fa9b00176387f8c37b98ffb83335ee5d794319950e4c6d8b7b276d6f7d0a2e3d65240ee160ece1a04b165cc2100f
MD5 SHA1 SHA512

Submit Download

svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAAACBBBBABCABCAABAACCBACBCCBBBABBACCBBCCCCCCBBABCC.exe
Size 14.7MB
SHA256 b5cdf0cccd034467548e5bc532fb139dfd0bbd8239d3fe4abf6dac90a2937d5b
MD5 4f82b30e3b00bb5aa6ea3b8845aeee0e
SHA1 4d0a4827e8cffea4b3ab6ac7537de8bf5024180d
SHA512 2c0b36cf7c4ef06a2e92cdb62d71c24c44e7d04e9d2848b71d984ec75be9519086912f427a01993c4726fe692d2c1e1352f8897f47fdfffac13593aff4dc2e78
SSDEEP 196608:BLZZ7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToue:PZahvQHrc8u3xXJ/f4uUWHb
TLSH
T164F69E13B35681E6C02AE2B88A474212E7B9BC440334B7DB16E5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2456-23-0x0000000000380000-0x00000000003A1000-memory.dmp

Download

memory/2456-33-0x0000000000380000-0x00000000003A1000-memory.dmp

Download

memory/2992-72-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download

memory/4424-67-0x0000000000380000-0x00000000003A1000-memory.dmp

Download

memory/5408-0-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/5408-7-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download