b395559b6bc4fea2f093b43a9ee88afc043cf5726803ff4616dc96d43cbd9e18

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 08:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_045c5e98a6ca5dca76df193bd3be9504_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 15.9MB
Sample260816-kmsmhatfke
SHA256 b395559b6bc4fea2f093b43a9ee88afc043cf5726803ff4616dc96d43cbd9e18
MD5 045c5e98a6ca5dca76df193bd3be9504
SHA1 a1973e2cc1a3e31f014f792cb26ca6f06c516e24
SHA512 c218bb2ed42d9bb569956f50c16add08c7b69b340439ea0710cb0056c2f1a61234a478b840a39da4ab304e0c01c53d42aaea78697ba8964f6313894668a6dd47
SSDEEP 196608:w5H577APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouT:w5H57ahvQHrc8u3xXJ/f4uUWHG
TLSH
T194F69E17B35681E6C02AE2B88A574323DBB57C440330A7DF1695B7692F37BE49B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001c641-19.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001c641-19.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001c641-19.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
7016	svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe
7076	svchost_CBCBBBABACCBACBCABCCBACCCBBCACBACBBBBABABCCBCCCBCACACAC.exe
3144	svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBACBABCCBACCCAABACCAAABBBABBAAAAACCACACCBBBAAACBCBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe"	2026-08-16_045c5e98a6ca5dca76df193bd3be9504_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACACABAAAABAACABCCAAABBBBCAAACCBBABCBACCBBACBCBCCBCCACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBBBABACCBACBCABCCBACCCBBCACBACBBBBABABCCBCCCBCACACAC.exe"	svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1156	sc.exe
6696	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6376	cmd.exe
5368	cmd.exe
2408	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_045c5e98a6ca5dca76df193bd3be9504_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBBBABACCBACBCABCCBACCCBBCACBACBBBBABABCCBCCCBCACACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3756	2026-08-16_045c5e98a6ca5dca76df193bd3be9504_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
3756	2026-08-16_045c5e98a6ca5dca76df193bd3be9504_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
3756	2026-08-16_045c5e98a6ca5dca76df193bd3be9504_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
3756	2026-08-16_045c5e98a6ca5dca76df193bd3be9504_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
7016	svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe
7016	svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe
7016	svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe
7016	svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3756	2026-08-16_045c5e98a6ca5dca76df193bd3be9504_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	7016	svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 6376	3756	2026-08-16_045c5e98a6ca5dca76df193bd3be9504_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 6376 wrote to memory of 7036	6376	cmd.exe	94
PID 7016 wrote to memory of 3456	7016	svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe	95
PID 3756 wrote to memory of 5368	3756	2026-08-16_045c5e98a6ca5dca76df193bd3be9504_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 5368 wrote to memory of 1156	5368	cmd.exe	100
PID 3756 wrote to memory of 2408	3756	2026-08-16_045c5e98a6ca5dca76df193bd3be9504_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	101
PID 2408 wrote to memory of 6696	2408	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_045c5e98a6ca5dca76df193bd3be9504_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_045c5e98a6ca5dca76df193bd3be9504_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABCACCABAABABACABACBAAACCAABAABCCCBAABAAACBBBBBCAACBCCACCAACCBCCACCABACCABACCBBAABBCBBABCABBCBACCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABCACCABAABABACABACBAAACCAABAABCCCBAABAAACBBBBBCAACBCCACCAACCBCCACCABACCABACCBBAABBCBBABCABBCBACCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:7036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCABBBCCCCBAACCCABAACCAAABCBACCACAAAACBCCABCCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe" start= auto displayName= "UserDataSvc_BBCCABBBCCCCBAACCCABAACCAAABCBACCACAAAACBCCABCCCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCABBBCCCCBAACCCABAACCAAABCBACCACAAAACBCCABCCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe" start= auto displayName= "UserDataSvc_BBCCABBBCCCCBAACCCABAACCAAABCBACCACAAAACBCCABCCCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCABBBCCCCBAACCCABAACCAAABCBACCACAAAACBCCABCCCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCABBBCCCCBAACCCABAACCAAABCBACCACAAAACBCCABCCCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:7016
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBABACCBACBCABCCBACCCBBCACBACBBBBABABCCBCCCBCACACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBABACCBACBCABCCBACCCBBCACBACBBBBABABCCBCCCBCACACAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe
1⤵
- Executes dropped EXE
PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ced0b985f3ed293582ffb2a7befd79fec54df16ed0a367702d582424d946e716
MD5 a73e1bf4a5d8906dfab89e2c9c3667e3
SHA1 d6a744cd380d2c5ba5734ec092b27586e282f06b
SHA512 8a8cb32219e31875ed53a4f728c08e2e406308550e2abef7f973b20538b842fa7942f00d895bb60ec3e512fd3f01da5535da0f460145338b36f4f738cfaa6ef5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 07d7bb43364e1b6b29c5ae7c270baa7ade11f973010c7262c36a155c5d2dcfb7
MD5 256f6ce456dfd33ea4dd0429ecc27e5b
SHA1 9dcd0b0a967fbe8e74b9da4bfd43bc57aaa045af
SHA512 96cf6c8f56ddbd5e32ec997c33badb73ace694a328b758d3ab4a32a42daf3132b883930decec28de3a4644ccf6aca5e5ba34b0ea0f6c56e6a66edfe855e1b76a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 13ebd96d0ef08a9843fbeddc7606b53e3c142a16d2ca9ab0ed1ec29c9206ff9f
MD5 8d8e5769600620227e8c51f41304902b
SHA1 e3f62e0b2872f3d18be3d02b5fac8f10d9a11580
SHA512 eed0e2f7a1fd5b18f03f6f8105be26d9aa60ca3af27340f9767d899d18fa1937d9cbaccc4f80dff1d8e5ec49017da78a9768e642e43938bb4afb11e73569d894
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f787554bd32b5984bd1aeecb6c001991b510a81ea7755b1ce1859fff033a58cb
MD5 9e024ed72837999bd19f97ed2bb8cf7e
SHA1 bc4029ae38ccc601991dd31474f4c4d5ea9daf88
SHA512 d2ddfbb9633520d601514b8e33c1aecdda3eec846a45ef5173ea1564bba348cd6fee030fec10b6cd2acac922b31c28723b7babf46707600d701cc74954c50a02
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 69f0d92018cbd5a01628dc58f7c5bf47e31b4979dd6ee21b8ac7b5708326b0e7
MD5 7aa6ce169b96568cb798d3664b942947
SHA1 7311e6f99ec4791b6706c073bfa7b521bcef15a1
SHA512 66da66af8a0db94101990ec73ab5ebeef4a51448478300c3148139db978f016e093790d50851f02c1477c21eaa790b87491479f385ab00da1c04b0c22cab5e03
MD5 SHA1 SHA512

Submit Download

svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCABBACBAACAACBBCCBCBCBABCCBABBBCCAAABCCACCCBCCBBCCA.exe
Size 15.9MB
SHA256 b395559b6bc4fea2f093b43a9ee88afc043cf5726803ff4616dc96d43cbd9e18
MD5 045c5e98a6ca5dca76df193bd3be9504
SHA1 a1973e2cc1a3e31f014f792cb26ca6f06c516e24
SHA512 c218bb2ed42d9bb569956f50c16add08c7b69b340439ea0710cb0056c2f1a61234a478b840a39da4ab304e0c01c53d42aaea78697ba8964f6313894668a6dd47
SSDEEP 196608:w5H577APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouT:w5H57ahvQHrc8u3xXJ/f4uUWHG
TLSH
T194F69E17B35681E6C02AE2B88A574323DBB57C440330A7DF1695B7692F37BE49B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3756-0-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/3756-7-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/7016-24-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/7016-34-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/7076-71-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download