976767a4430f808ff48bb0a4bfd6fdaab719e7516b494828f7cd73102f6a5f21

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_149ff16a74b7e1fabbdafcaae70d2bf5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 16.1MB
Sample260815-cajvtswgrf
SHA256 976767a4430f808ff48bb0a4bfd6fdaab719e7516b494828f7cd73102f6a5f21
MD5 149ff16a74b7e1fabbdafcaae70d2bf5
SHA1 2b436c834d1a4701868797075d5814fdddabdd60
SHA512 05d1f419a8987f2f3e25565078c74d5514e8978d3b635e2d21f8cc251c5d7e0da20b3ec3ca7e8dc770d9ada45d95b4ceb4d0f0761ebc6d7b271765b1686ccc4f
SSDEEP 196608:K7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouB:KahvQHrc8u3xXJ/f4uUWHA
TLSH
T1E7079D13B35A81E6C02AD2B88A574213E7B5BC440725A7DB22D5B76D2F33BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c517-20.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c517-20.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c517-20.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5800	svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe
1876	svchost_AAACACBCBCBBCCAAAABBAACBABBBCBACBCACBBBACABBBABCACBACBC.exe
2920	svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCACAAABCCBBCBCBAACCACCABACBBBABCCCABCAACACACAAAABCACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe"	2026-08-15_149ff16a74b7e1fabbdafcaae70d2bf5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACACAABAABCABAACCCABBBBAACBBCCACCBCACBAACBACAABCBCACCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACACBCBCBBCCAAAABBAACBABBBCBACBCACBBBACABBBABCACBACBC.exe"	svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3704	sc.exe
2440	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3868	cmd.exe
1288	cmd.exe
5528	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_149ff16a74b7e1fabbdafcaae70d2bf5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACACBCBCBBCCAAAABBAACBABBBCBACBCACBBBACABBBABCACBACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
768	2026-08-15_149ff16a74b7e1fabbdafcaae70d2bf5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
768	2026-08-15_149ff16a74b7e1fabbdafcaae70d2bf5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
768	2026-08-15_149ff16a74b7e1fabbdafcaae70d2bf5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
768	2026-08-15_149ff16a74b7e1fabbdafcaae70d2bf5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5800	svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe
5800	svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe
5800	svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe
5800	svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe
1876	svchost_AAACACBCBCBBCCAAAABBAACBABBBCBACBCACBBBACABBBABCACBACBC.exe
1876	svchost_AAACACBCBCBBCCAAAABBAACBABBBCBACBCACBBBACABBBABCACBACBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	768	2026-08-15_149ff16a74b7e1fabbdafcaae70d2bf5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	5800	svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe
Token: SeDebugPrivilege	1876	svchost_AAACACBCBCBBCCAAAABBAACBABBBCBACBCACBBBACABBBABCACBACBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 3868	768	2026-08-15_149ff16a74b7e1fabbdafcaae70d2bf5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 3868 wrote to memory of 2872	3868	cmd.exe	94
PID 5800 wrote to memory of 1488	5800	svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe	95
PID 768 wrote to memory of 1288	768	2026-08-15_149ff16a74b7e1fabbdafcaae70d2bf5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 1288 wrote to memory of 3704	1288	cmd.exe	100
PID 768 wrote to memory of 5528	768	2026-08-15_149ff16a74b7e1fabbdafcaae70d2bf5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	101
PID 5528 wrote to memory of 2440	5528	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_149ff16a74b7e1fabbdafcaae70d2bf5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_149ff16a74b7e1fabbdafcaae70d2bf5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBCACBABCACCCBABBCBBBAAABACBAABBAAABACAAABAABBCCABBBCABCAAACCACBBBACAABABBBCBCABACAABCBBBCBCCBBCCCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBCACBABCACCCBABBCBBBAAABACBAABBAAABACAAABAABBCCABBBCABCAAACCACBBBACAABABBBCBCABACAABCBBBCBCCBBCCCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABACCBCAABABBAACABCBBBCCCBBAACBBCCBCCCBCCBABBCCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe" start= auto displayName= "UserDataSvc_BABACCBCAABABBAACABCBBBCCCBBAACBBCCBCCCBCCBABBCCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABACCBCAABABBAACABCBBBCCCBBAACBBCCBCCCBCCBABBCCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe" start= auto displayName= "UserDataSvc_BABACCBCAABABBAACABCBBBCCCBBAACBBCCBCCCBCCBABBCCBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABACCBCAABABBAACABCBBBCCCBBAACBBCCBCCCBCCBABBCCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABACCBCAABABBAACABCBBBCCCBBAACBBCCBCCCBCCBABBCCBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2440

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACBCBCBBCCAAAABBAACBABBBCBACBCACBBBACABBBABCACBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACBCBCBBCCAAAABBAACBABBBCBACBCACBBBACABBBABCACBACBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe
1⤵
- Executes dropped EXE
PID:2920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fc69420e2998e3b71589ea95fffa82fca726b674a52208adb9fa586c961d2b8d
MD5 eef72e2bf806a6a6ca84ae7e2e95b02a
SHA1 ee0613e30a0bc6951e5372b6baae8ba86cea98f3
SHA512 2c31a7239d5a476870d9027b937134098121624cf41b581962e8a330f77caf67a0f2632147e1500c4b631d18586dda27f999809c5ccaf3877f87d85436aa8a9b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6873e27bfa724018f92e945a7591943cfb4036996b1ba98630edc6dc7cad78c2
MD5 e18453d5914d32ff899882dd4df609a8
SHA1 41f13549a727c728db881e3cd6c859cbe7eb562d
SHA512 62439d740b46871b03a155928149c55fc26550c3e76c9d9d1d4efc2e82a5bbd092570710eb010cb5602f14ca3377cff9bf1c29a87cef1e94b85eaade74712f25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c260caed3f95c999b931b39b94ba55b827580676d5231e1fc38159ebee3dff9d
MD5 8472e9113f6280b95af681cb695c0b8c
SHA1 fdf3a589867d734b8685b3d8d44b869d4f139734
SHA512 d8dc48dbe2d91ee54c23b5f7ebcacb4b5934880db50d03fd16e64ad9258c3b45258fcf237be8f050937e1728f929c98be650aed3baf7923fc8827edaec4daafb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2f959ff6bd6e10b786c4a7a266c6d3c47be3b0f4423e8805e11765658d35f22b
MD5 fb044448d0ab3bc6c3bb17198ca294ae
SHA1 5750a3900e9f2cde8ca60e52e293e8ffc2700da6
SHA512 1b822cdc281d297e416551b2eed28eb1de577d75157e8defc3922e135e69234082c8d2dcd8f191177af913e0703c8075aa2d2f2c638d84246efad12c60288613
MD5 SHA1 SHA512

Submit Download

svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBACABCABACCBCBBBCCCBCAAACABCABCCABCCCBBBCCBAAACCBA.exe
Size 16.1MB
SHA256 976767a4430f808ff48bb0a4bfd6fdaab719e7516b494828f7cd73102f6a5f21
MD5 149ff16a74b7e1fabbdafcaae70d2bf5
SHA1 2b436c834d1a4701868797075d5814fdddabdd60
SHA512 05d1f419a8987f2f3e25565078c74d5514e8978d3b635e2d21f8cc251c5d7e0da20b3ec3ca7e8dc770d9ada45d95b4ceb4d0f0761ebc6d7b271765b1686ccc4f
SSDEEP 196608:K7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouB:KahvQHrc8u3xXJ/f4uUWHA
TLSH
T1E7079D13B35A81E6C02AD2B88A574213E7B5BC440725A7DB22D5B76D2F33BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 9913c6672d46910b941dfeb764556bd9a0732632873fe0faf2dcebe7a397cf43
MD5 e419e3115fac19c8a4691d80ed82773d
SHA1 1a0011b98798536668f8f59dfd99e1b1950f296e
SHA512 a975c76b4dde5d97b01148746220db73a3f4b8a244fdf8fab763448a41ee1983acd93032350b0bc345d811534c785308750ef18c082d8a2ae9523519c26122c7
TLSH
T14D110451A4E5E823FC3268CF9E19CA925CF43A9B585C6E14234C8119B7D8C318D194D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/768-0-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/768-8-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/1876-81-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/5800-34-0x0000000000BC0000-0x0000000000BE1000-memory.dmp

Download