640be8f07e998855291bc84be0a27d213be608e7d560df129fb7bf7083fc677b

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_d06b39282e66dc56657302c732b10413_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 19.0MB
Sample260818-da734avbqf
SHA256 640be8f07e998855291bc84be0a27d213be608e7d560df129fb7bf7083fc677b
MD5 d06b39282e66dc56657302c732b10413
SHA1 58e5604c32d1633bbc351c543e8efb462c25a700
SHA512 e0be1e2807dc4da82dc10747b8adb5a1a69468a6ab923fe55dd70dbedf37ab730e424fc11a46063e5a90c830cfa11929ec1ceb90a5771462ffd23d4e25d64b6b
SSDEEP 393216:gT59T59T59T59T59T5J/ahvQHrc8u3xXJ/f4uUWHP:gT59T59T59T59T59T5JIvQHrK5/f4uUm
TLSH
T14E17AE17B39641A6D167D2B88A5B8222EB797C100330A7DF16D4B6193F37BE09B3B351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c424-20.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c424-20.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c424-20.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
1228	svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe
3764	svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCCBACACCBAABCBBCCAABBCCBCBAACBCCABBBCCACBCAAABCCAACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe"	2026-08-17_d06b39282e66dc56657302c732b10413_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5700	sc.exe
4088	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5932	cmd.exe
5352	cmd.exe
1768	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_d06b39282e66dc56657302c732b10413_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3528	2026-08-17_d06b39282e66dc56657302c732b10413_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
3528	2026-08-17_d06b39282e66dc56657302c732b10413_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
3528	2026-08-17_d06b39282e66dc56657302c732b10413_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
3528	2026-08-17_d06b39282e66dc56657302c732b10413_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1228	svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe
1228	svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe
1228	svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe
1228	svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3528	2026-08-17_d06b39282e66dc56657302c732b10413_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	1228	svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 5932	3528	2026-08-17_d06b39282e66dc56657302c732b10413_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 5932 wrote to memory of 2216	5932	cmd.exe	94
PID 3528 wrote to memory of 5352	3528	2026-08-17_d06b39282e66dc56657302c732b10413_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	95
PID 5352 wrote to memory of 5700	5352	cmd.exe	97
PID 3528 wrote to memory of 1768	3528	2026-08-17_d06b39282e66dc56657302c732b10413_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 1768 wrote to memory of 4088	1768	cmd.exe	100
PID 1228 wrote to memory of 452	1228	svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-17_d06b39282e66dc56657302c732b10413_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_d06b39282e66dc56657302c732b10413_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABBABCBCCACBBCABCABAAACCAABAABAABBCCBBCCBAAAABBABBBBAABACBCABCACCABAACCCCBCAABABBBBAACCBCABCBBCBAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABBABCBCCACBBCABCABAAACCAABAABAABBCCBBCCBAAAABBABBBBAABACBCABCACCABAACCCCBCAABABBBBAACCBCABCBBCBAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBCBAABABABCABBABBABCBCBCCCBBACCACBAAABCACCACABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe" start= auto displayName= "UserDataSvc_ABCBCBAABABABCABBABBABCBCBCCCBBACCACBAAABCACCACABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBCBAABABABCABBABBABCBCBCCCBBACCACBAAABCACCACABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe" start= auto displayName= "UserDataSvc_ABCBCBAABABABCABBABBABCBCBCCCBBACCACBAAABCACCACABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBCBAABABABCABBABBABCBCBCCCBBACCACBAAABCACCACABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBCBAABABABCABBABBABCBCBCCCBBACCACBAAABCACCACABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe
1⤵
- Executes dropped EXE
PID:3764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 76eaabe4597604933ae53281831e764d626abb7c6ce721b6763817945256bf73
MD5 0f92eb4b1efe73b03c47fb38ecc9a403
SHA1 97dba77a8b95e295009430bf02b88c7a7429360a
SHA512 251d55737058f0fbcc3f90e33530ec723b9a8dd4aabd291eec45dec3b566e0dc09a0d22a4e1dd2f573c11bd8109ab942d7eba3e97a84fe2ed9e43a210bfa2dee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cbfd1bc3965ea5f2e77b84779fc215b052097ba205780ea93d23dfae7e523bfb
MD5 8c8baf56d7635680d46180a08277b517
SHA1 1aa436603b69a832d7e500920ad9b4e47b8a4799
SHA512 51abad573e9365678d5dd75b1bb62efa4101378b6de1e22c0e82a2e4c8fcc6736a0481fe380fb363aa7e02b80fa4138f59b66a3186f4b332054d678481701db5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d4ee61139f31faa67bf6a1a856259ff72f88a7ab587352addb9132ebf9bb7700
MD5 42703dbbc8ca4c380feefc75d1993729
SHA1 51e852a1fa38ec86b3daf60c7ef90acf0d1f8ada
SHA512 cfd2b30b202e6e2e981c069c78ccd29b5c04d24e8a5f132ec23a92f715a8251ec1579327c56e05b8bb8fc9fc77ee1dd1cca57650409373b6c18ee4791f7e7dfb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e0acf3f3b2c1e7b6bf0ba0c33c1523b7f8e436064de980b10717eaa10760d256
MD5 8885aea152cff2c3c4836527c97d9e7a
SHA1 93b1344b3201b50a9434c7f48d6a7a67b1d7c31b
SHA512 2e20e0e4f142ed7639ebde79180a5755e23bb641f868f2eededbafcbbab84464fb3c21666a5be95c7694639db25db8b5c5209aa235c3695ba899f1a2eeb3d480
MD5 SHA1 SHA512

Submit Download

svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAAACBABBCCCCCAACCCABBABCBCBABCBCCCCACABABBBBBBCCAC.exe
Size 19.0MB
SHA256 640be8f07e998855291bc84be0a27d213be608e7d560df129fb7bf7083fc677b
MD5 d06b39282e66dc56657302c732b10413
SHA1 58e5604c32d1633bbc351c543e8efb462c25a700
SHA512 e0be1e2807dc4da82dc10747b8adb5a1a69468a6ab923fe55dd70dbedf37ab730e424fc11a46063e5a90c830cfa11929ec1ceb90a5771462ffd23d4e25d64b6b
SSDEEP 393216:gT59T59T59T59T59T5J/ahvQHrc8u3xXJ/f4uUWHP:gT59T59T59T59T59T5JIvQHrK5/f4uUm
TLSH
T14E17AE17B39641A6D167D2B88A5B8222EB797C100330A7DF16D4B6193F37BE09B3B351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1228-24-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Download

memory/1228-37-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Download

memory/3528-0-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/3528-8-0x0000000000900000-0x0000000000921000-memory.dmp

Download