1b0e583d130b58365f5b2d68ad6d3c1be2837997846ae55627e82068e82c8c9a

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_40cbea11702e71044f922b625f0f371c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Size 14.8MB
Sample260814-faatpscq81
SHA256 1b0e583d130b58365f5b2d68ad6d3c1be2837997846ae55627e82068e82c8c9a
MD5 40cbea11702e71044f922b625f0f371c
SHA1 263200800a1a22f934601cccbeb7234286e6cdf3
SHA512 26dce6b1d826765d6fe66861c9a9605f70a00d5fe38e8173090135b30c74cf24356ce622646ae5700d1a4b6cbbc9448a3b1e1e0271635762e2111d11a8203248
SSDEEP 196608:C7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouF:CahvQHrc8u3xXJ/f4uUWHM
TLSH
T10EF69E17B35A81E6C02AE2B88A474212D7BA7C440334B7DB12D5B7692F77BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4a4-19.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4a4-19.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4a4-19.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2448	svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe
1216	svchost_CCACAACABBACCCAACCABCBBCBBACCBBABCBBACBCCCABCAAAAACBCCA.exe
2584	svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCBBBAABCBBACCACBCCBBCAAAAACCCCCBBBBCAACAABBBBCBABBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe"	2026-08-14_40cbea11702e71044f922b625f0f371c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBCCACBCABBACBCAAABACBCCBACBCBAACBBAACCBCBCCAAACABABBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACAACABBACCCAACCABCBBCBBACCBBABCBBACBCCCABCAAAAACBCCA.exe"	svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1180	sc.exe
2828	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4808	cmd.exe
828	cmd.exe
4352	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_40cbea11702e71044f922b625f0f371c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACAACABBACCCAACCABCBBCBBACCBBABCBBACBCCCABCAAAAACBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4408	2026-08-14_40cbea11702e71044f922b625f0f371c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
4408	2026-08-14_40cbea11702e71044f922b625f0f371c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
4408	2026-08-14_40cbea11702e71044f922b625f0f371c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
4408	2026-08-14_40cbea11702e71044f922b625f0f371c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
2448	svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe
2448	svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe
2448	svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe
2448	svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe
1216	svchost_CCACAACABBACCCAACCABCBBCBBACCBBABCBBACBCCCABCAAAAACBCCA.exe
1216	svchost_CCACAACABBACCCAACCABCBBCBBACCBBABCBBACBCCCABCAAAAACBCCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	2026-08-14_40cbea11702e71044f922b625f0f371c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Token: SeDebugPrivilege	2448	svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe
Token: SeDebugPrivilege	1216	svchost_CCACAACABBACCCAACCABCBBCBBACCBBABCBBACBCCCABCAAAAACBCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 4808	4408	2026-08-14_40cbea11702e71044f922b625f0f371c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	92
PID 4808 wrote to memory of 572	4808	cmd.exe	94
PID 2448 wrote to memory of 5416	2448	svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe	95
PID 4408 wrote to memory of 828	4408	2026-08-14_40cbea11702e71044f922b625f0f371c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	98
PID 828 wrote to memory of 1180	828	cmd.exe	100
PID 4408 wrote to memory of 4352	4408	2026-08-14_40cbea11702e71044f922b625f0f371c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	101
PID 4352 wrote to memory of 2828	4352	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_40cbea11702e71044f922b625f0f371c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_40cbea11702e71044f922b625f0f371c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAABCBBBCACACBCAACAACABBACAAACBBCBBBCBABBBABABAAABBCACACBCACABBABACBCABBCBAABABBBBBCBCAAAACCBCBBACAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAABCBBBCACACBCAACAACABBACAAACBBCBBBCBABBBABABAAABBCACACBCACABBABACBCABBCBAABABBBBBCBCAAAACCBCBBACAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBABCACBBBBCCAACCCBBAAACAABBCCBACABABBBBBAACCABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe" start= auto displayName= "UserDataSvc_AACBABCACBBBBCCAACCCBBAAACAABBCCBACABABBBBBAACCABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBABCACBBBBCCAACCCBBAAACAABBCCBACABABBBBBAACCABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe" start= auto displayName= "UserDataSvc_AACBABCACBBBBCCAACCCBBAAACAABBCCBACABABBBBBAACCABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBABCACBBBBCCAACCCBBAAACAABBCCBACABABBBBBAACCABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBABCACBBBBCCAACCCBBAAACAABBCCBACABABBBBBAACCABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAACABBACCCAACCABCBBCBBACCBBABCBBACBCCCABCAAAAACBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAACABBACCCAACCABCBBCBBACCBBABCBBACBCCCABCAAAAACBCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe
1⤵
- Executes dropped EXE
PID:2584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b49b40add4508f38108148fe1ef1b2d1e8bb99c1b8637540a4f68151c46bc8b0
MD5 f3456999eba93eef3c387116efd7192b
SHA1 81e96d3fa15afce4f9f51b569b7f83773d5c6fad
SHA512 4ed0fb00e9e49ce76c62402e2bfe3c323c3016c74ba8d1b0dfda083077629f0583e6bf9edb561573087f93ae8fac42c98fd863181c4f2d1bd44049f3113baab4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f007f40c654ae85de193307d11ee58ca438ec5af20bdf94d019d89168d0af98b
MD5 694b9979af5fee61c02e982e2b208586
SHA1 0f979dc9ea88fadb697bc3b316482ce10ae25fec
SHA512 57bb7e2c529734d963127f1f75b4cf34e30b2653cce0cbf2a931fb786cf3458ae9bbe3f1617ebd529094c39c244d87270f4907b5b1b5e4868cdbf7ab7fd67019
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5161733503a8235be3e24db89d08c7d692b3eac078ed1ea35bd4030a49633bc4
MD5 ae44a163d01759665dd11688cc67adc5
SHA1 6aca43c14544057da7b6910690d8be8108f1a802
SHA512 399e76229b92b74eb71fb7ae76f23e4a9e38bcd7de4eacf98ec5d8a0f42803fb7ef3815236567c736a2b9f8273708dfc7f072313565d3570344b7cc3980223bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b42d9fefed7fe27b5957d4f21579089c68f681e231c6f735f302c82b87e2d872
MD5 1666627dc52e2bb5e04e1cbc23d915b3
SHA1 1e32d6af98ee69ed22bc5c298d43fcbe54f2523a
SHA512 8e171e8369adea48b39061a789c3b96713a3fad20ee1f751ead3de003c4fe68fe87daec4c1dbccf39bbb814c3842dbf11716bd142469edecc27626e7312aaa19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 58fd57c330eb7834f2e11c823fd41cc64fce84b124ce29c77075546efa4f09c4
MD5 1f7a827d5ddb08c6e9d1b4850910b662
SHA1 78de524eff63cc44b0e51afc7bbec777c4ad3122
SHA512 a36150785628679e30b8484dbeffc4ecc80730f52c16294a1f1c3c938e276be8a778d45d089bf4271d258ec6033bb8afc1d8668bde030a6d6c65ccca4916ae24
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9909fc485d482a57a880c63e9ebfae0d576e9dca7bdbd0342f62b790d0dcaf63
MD5 3c8273941ce619c473b28a9e2284e71f
SHA1 7f2e1af729f03309385c4031365b241d149dbb32
SHA512 41945036fbf32968456d94af4bb22f6238c1b0b29b021cfc825f82aaf3b39bef290bbdc53896c1265970c691095a71a7b89e2b307d015774a0c78b40391ffa6f
MD5 SHA1 SHA512

Submit Download

svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACBACBBABBBACACAACBABCCACBAABAAABCBABCAABACCCBABAB.exe
Size 14.8MB
SHA256 1b0e583d130b58365f5b2d68ad6d3c1be2837997846ae55627e82068e82c8c9a
MD5 40cbea11702e71044f922b625f0f371c
SHA1 263200800a1a22f934601cccbeb7234286e6cdf3
SHA512 26dce6b1d826765d6fe66861c9a9605f70a00d5fe38e8173090135b30c74cf24356ce622646ae5700d1a4b6cbbc9448a3b1e1e0271635762e2111d11a8203248
SSDEEP 196608:C7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouF:CahvQHrc8u3xXJ/f4uUWHM
TLSH
T10EF69E17B35A81E6C02AE2B88A474212D7BA7C440334B7DB12D5B7692F77BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7f85793f650565813585e92f4dca5d088c7799b345c201ab272e3ed08d585dc4
MD5 e7a668ac321cf54ed0f7417c3210617f
SHA1 34f812a41993d1ae472a3d2cb4f4a5f1c2b26aac
SHA512 ddd1ef1af4bbd913077f7e0e2a99d0a609144f20d1419cecd0c7c8085c31184e861b8134eaecb53c2fa5638fc0b1812083d91cdd4ffc7b89d06e43cf5a5af46a
TLSH
T18911EB64E8E5DC33F933689B452D9FC30CB8768FDC586E94230942286BA5D318D558E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1216-70-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/2448-31-0x00000000004A0000-0x00000000004C1000-memory.dmp

Download

memory/4408-0-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/4408-7-0x00000000007F0000-0x0000000000811000-memory.dmp

Download