fe981e655f126a49d895e0163ae858fef02e7aeb7e5f9c6bdffc7d4e749bf885

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_0c9681fd27678a2572f2db3bac336b46_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 16.6MB
Sample260815-e1zebaeq3w
SHA256 fe981e655f126a49d895e0163ae858fef02e7aeb7e5f9c6bdffc7d4e749bf885
MD5 0c9681fd27678a2572f2db3bac336b46
SHA1 6bdeaa7e092d8beaaf67b6e3fa9565e8d5498603
SHA512 5e7214816392aa09f91bfb14ce99bb6e72faa1188add7676ffa909b423003e939ff00e853cf6d24190b6a6dc48bb71b7fb21f9773dd714cc8d67695fe7d1a7a8
SSDEEP 196608:G5X7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou4:G5XahvQHrc8u3xXJ/f4uUWHN
TLSH
T191079E17B35A81E6C02AD2B88A574323D7B5BC440721A7DF2295B76D2F33BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4ee-18.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4ee-18.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4ee-18.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2564	svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe
1956	svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe
928	svchost_ABCAACCBACBBBACAAABBACCCAACAAAAAAACCCCABBCABCAAABBABCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACACCCBBAAABAACABACBABCBBACBCBCAACABBABBCABACCBACCBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe"	2026-08-15_0c9681fd27678a2572f2db3bac336b46_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCACCABABCBACBCAABCACBABCABCBABCBBBBBCBACBABBBBBCACAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCAACCBACBBBACAAABBACCCAACAAAAAAACCCCABBCABCAAABBABCBB.exe"	svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4676	sc.exe
4776	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4408	cmd.exe
5740	cmd.exe
1132	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_0c9681fd27678a2572f2db3bac336b46_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCAACCBACBBBACAAABBACCCAACAAAAAAACCCCABBCABCAAABBABCBB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2152	2026-08-15_0c9681fd27678a2572f2db3bac336b46_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2152	2026-08-15_0c9681fd27678a2572f2db3bac336b46_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2152	2026-08-15_0c9681fd27678a2572f2db3bac336b46_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2152	2026-08-15_0c9681fd27678a2572f2db3bac336b46_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2564	svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe
2564	svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe
2564	svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe
2564	svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe
928	svchost_ABCAACCBACBBBACAAABBACCCAACAAAAAAACCCCABBCABCAAABBABCBB.exe
928	svchost_ABCAACCBACBBBACAAABBACCCAACAAAAAAACCCCABBCABCAAABBABCBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	2026-08-15_0c9681fd27678a2572f2db3bac336b46_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	2564	svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe
Token: SeDebugPrivilege	928	svchost_ABCAACCBACBBBACAAABBACCCAACAAAAAAACCCCABBCABCAAABBABCBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 5740	2152	2026-08-15_0c9681fd27678a2572f2db3bac336b46_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 5740 wrote to memory of 1684	5740	cmd.exe	94
PID 2152 wrote to memory of 1132	2152	2026-08-15_0c9681fd27678a2572f2db3bac336b46_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	95
PID 2564 wrote to memory of 4812	2564	svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe	96
PID 1132 wrote to memory of 4676	1132	cmd.exe	98
PID 2152 wrote to memory of 4408	2152	2026-08-15_0c9681fd27678a2572f2db3bac336b46_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	99
PID 4408 wrote to memory of 4776	4408	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-15_0c9681fd27678a2572f2db3bac336b46_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_0c9681fd27678a2572f2db3bac336b46_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBACAABCABCCCCBCABAACBCACCABACACCCBBABBCAABCBABABACAACACCCBBCCABBBCCABCACBCBBACBCACAABAABACBBAAACBCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBACAABCABCCCCBCABAACBCACCABACACCCBBABBCAABCBABABACAACACCCBBCCABBBCCABCACBCBBACBCACAABAABACBBAAACBCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABBCABAAACBBACCCCAABBACCACACAACBACAAACBCAACAACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe" start= auto displayName= "UserDataSvc_CBABBCABAAACBBACCCCAABBACCACACAACBACAAACBCAACAACCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABBCABAAACBBACCCCAABBACCACACAACBACAAACBCAACAACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe" start= auto displayName= "UserDataSvc_CBABBCABAAACBBACCCCAABBACCACACAACBACAAACBCAACAACCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABBCABAAACBBACCCCAABBACCACACAACBACAAACBCAACAACCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABBCABAAACBBACCCCAABBACCACACAACBACAAACBCAACAACCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe
1⤵
- Executes dropped EXE
PID:1956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACCBACBBBACAAABBACCCAACAAAAAAACCCCABBCABCAAABBABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACCBACBBBACAAABBACCCAACAAAAAAACCCCABBCABCAAABBABCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3a3cfaa2dcd56cbf416b2d0ac103faf9315b357b6366ac9e5e2f615bf8ccbdd3
MD5 e5c0c62af90f94455a1433ca53db60f4
SHA1 6c30241203f6513ca845de223b0cd4bab8aa34d8
SHA512 4a54a99b9714914e10a7817e68de5f7f4e79346198d2c886dc7839a378414b25f6d61e615d0e8092bd0335d7acdcd23af4f97298f2784ba74e1fe2f9024492fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2ef2a8d82fbbcba1716e7f7492105094f75f288074fa284587cddb160f298f21
MD5 0255283b8f493f67256339e0c889b013
SHA1 a1c205e321fa5ff873a911f9f86145313cf96ea5
SHA512 7d14c16cfde9cb80d54d56bf67e18f41a00c9398f73ec8d05518e695fc6bd558fcff69059988b876edd6b581ce373c10aec661dd4bf02713d331a6893202cd20
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 15c0ce5a766b675d3b0905705390730966a67f860513906eda15e75860d4efb9
MD5 bd44e331bd4ef66c52811d4ad6e89ed0
SHA1 cde2e656b5f3f37d66886c1b811d1cdab59493e6
SHA512 d5aefc9fbe72d9d56778a6d67e725652174e41fda321c51e2bf3e985a87b6ef4891105585456e5ba2df2631e837c8d076be4c2ed3e94a5a8b68ad77d815aceb4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 db5ecb9269a3da3cc1ef5b00c2ca1d669f80a0cc18fbc58e7c8665c53be6e674
MD5 4dcf98c1e6d79b828b145d47ec9db7a8
SHA1 6bee5bb03d53ff714131e6b5d46940a35bdbd8b8
SHA512 36ab698b29dda51f93eb9cb36fc1f862b70a1f782d380705d492f27502f43fa02a7161b04ee835ebadb4bf31181b5c45e45f0f09fcdd6259bbede5fbbf920dad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 40bea53e36b3a75183f0e8d047345b47945cfa0230a47068a6465ba3a19e685c
MD5 851a54fe70c917cae79310f04e9a7ada
SHA1 02703a97ccce44b8bb85d9017dfdc8f690f6f9de
SHA512 a67303ebeb1407565e473eb0db71d52417fdefb32ff0cb998225147acc282cdd1c287747aa70a5884ff6841da78d3bd74d87b6b3ff902f873e5502f0bd06a146
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 def817bd909c344480a9f72d015391c376090f7619409ea5fcc95dd115842a41
MD5 198f1f1fb1582d5b2b0a8e9776cf1839
SHA1 3c7345e12142e5443416d7385c1a7e9724ff8393
SHA512 111d6a18371e7d3e51c9ec4a7272e029a896c5ad43549ac6a827c89cee01d981faddfcf8c663e4ab250d231d537179234f5f7ccc0b569432a420416d496c5cb1
MD5 SHA1 SHA512

Submit Download

svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCABACAACBBCBABBACBCCCCCCBABBACCBBCCBBABABCAACBBAABB.exe
Size 16.6MB
SHA256 fe981e655f126a49d895e0163ae858fef02e7aeb7e5f9c6bdffc7d4e749bf885
MD5 0c9681fd27678a2572f2db3bac336b46
SHA1 6bdeaa7e092d8beaaf67b6e3fa9565e8d5498603
SHA512 5e7214816392aa09f91bfb14ce99bb6e72faa1188add7676ffa909b423003e939ff00e853cf6d24190b6a6dc48bb71b7fb21f9773dd714cc8d67695fe7d1a7a8
SSDEEP 196608:G5X7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou4:G5XahvQHrc8u3xXJ/f4uUWHN
TLSH
T191079E17B35A81E6C02AD2B88A574323D7B5BC440721A7DF2295B76D2F33BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 c9e0bea624addbe0c72993b4025c1ed1dd1e76ea9bd657873f7529017c7cc3b9
MD5 913d2dc2f443e576e459ce4c7fb42c8c
SHA1 827af6a3cb2ca509facb50da26580a24318c782a
SHA512 2d978d3afc0771cffa71af3732e26a245be5eaf0cc12111055cd4bd653fbb284a62b8049dac1a84d59e5d6b5cb3e8a22e44260de6c940c4385b5d37bff515660
TLSH
T10511E770E8E5E867F93338DA4A29CB820CF8299F9C586E945305831877C5D32CD558E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/928-81-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/1956-66-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/2152-6-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/2564-22-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/2564-35-0x0000000000120000-0x0000000000141000-memory.dmp

Download