2644b5894b19b156b34ac555e044390c6d0fb48c16ac64a3d94e40520652f084

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_9258abe1fdb9c7a63819138ebc761322_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 18.9MB
Sample260818-dmembawsdx
SHA256 2644b5894b19b156b34ac555e044390c6d0fb48c16ac64a3d94e40520652f084
MD5 9258abe1fdb9c7a63819138ebc761322
SHA1 d58fa919ca0c2c9815d82823f6e9159a794eebc5
SHA512 e8775aa0f21ca5b78ad1f6efaf7efd441e61355b3c39d55d6094b5cb17e1ca1febd2b74d97c903cfbbc68da82493c46e8bbbf2bb8a8c9a1ee8f459d4e00e0609
SSDEEP 196608:ILZJLZkLZ07APhNNECwHrc8u3x3AEcq/fByuKlWH3CTour:M3o0ahvQHrc8u3xXJ/f4uUWHW
TLSH
T116179E17F64680F6C42AD2B48A4B8337D775BC044321ABDB66D5A76A2F33BE0573A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x000800000002449c-21.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral1/files/0x000800000002449c-21.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x000800000002449c-21.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
540	svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe
2456	svchost_BBCCABBAACACCCCBABABBABACABBCCCBCCAABBCCCACACAACABBCCCA.exe
1592	svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BAABCABAABAACABCAACAACBBBABBBCABCCAAAAAAACAABACBCCCABAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe"	2026-08-17_9258abe1fdb9c7a63819138ebc761322_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCAACCBACCBCAAAACAABCAAAAAABAAACCABBCBBBBBBACBCBCCACCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCABBAACACCCCBABABBABACABBCCCBCCAABBCCCACACAACABBCCCA.exe"	svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2760	sc.exe
4964	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1564	cmd.exe
2476	cmd.exe
3784	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_9258abe1fdb9c7a63819138ebc761322_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCABBAACACCCCBABABBABACABBCCCBCCAABBCCCACACAACABBCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1680	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2948	2026-08-17_9258abe1fdb9c7a63819138ebc761322_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2948	2026-08-17_9258abe1fdb9c7a63819138ebc761322_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2948	2026-08-17_9258abe1fdb9c7a63819138ebc761322_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2948	2026-08-17_9258abe1fdb9c7a63819138ebc761322_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
540	svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe
540	svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe
540	svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe
540	svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe
2456	svchost_BBCCABBAACACCCCBABABBABACABBCCCBCCAABBCCCACACAACABBCCCA.exe
2456	svchost_BBCCABBAACACCCCBABABBABACABBCCCBCCAABBCCCACACAACABBCCCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	2026-08-17_9258abe1fdb9c7a63819138ebc761322_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	540	svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe
Token: SeDebugPrivilege	2456	svchost_BBCCABBAACACCCCBABABBABACABBCCCBCCAABBCCCACACAACABBCCCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4836	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 1564	2948	2026-08-17_9258abe1fdb9c7a63819138ebc761322_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 1564 wrote to memory of 1680	1564	cmd.exe	100
PID 540 wrote to memory of 1072	540	svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe	101
PID 1072 wrote to memory of 1112	1072	notepad.exe	102
PID 2948 wrote to memory of 2476	2948	2026-08-17_9258abe1fdb9c7a63819138ebc761322_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	106
PID 2476 wrote to memory of 2760	2476	cmd.exe	108
PID 2948 wrote to memory of 3784	2948	2026-08-17_9258abe1fdb9c7a63819138ebc761322_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	109
PID 3784 wrote to memory of 4964	3784	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-17_9258abe1fdb9c7a63819138ebc761322_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_9258abe1fdb9c7a63819138ebc761322_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBABBABACBCABCBCACAACABABCBCBCCBAABACABCACBACBCCBABABAACAAAABCACACCBCBCAACCABCCCBABBAABCCCABABABCBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBABBABACBCABCBCACAACABABCBCBCCBAABACABCACBACBCCBABABAACAAAABCACACCBCBCAACCABCCCBABBAABCCCABABABCBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCAACBCCABCCABCACABBCCCBCCCACCABCAACAACCACABBABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe" start= auto displayName= "UserDataSvc_CABCAACBCCABCCABCACABBCCCBCCCACCABCAACAACCACABBABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCAACBCCABCCABCACABBCCCBCCCACCABCAACAACCACABBABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe" start= auto displayName= "UserDataSvc_CABCAACBCCABCCABCACABBCCCBCCCACCABCAACAACCACABBABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCAACBCCABCCABCACABBCCCBCCCACCABCAACAACCACABBABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCAACBCCABCCABCACABBCCCBCCCACCABCAACAACCACABBABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4964

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1112

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4836

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABBAACACCCCBABABBABACABBCCCBCCAABBCCCACACAACABBCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABBAACACCCCBABABBABACABBCCCBCCAABBCCCACACAACABBCCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe
1⤵
- Executes dropped EXE
PID:1592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a6ce9c26dbf6f69d2f425f1ebb7b50cace1085fff81b1375bad7568fd9bd0a72
MD5 ba7732df2418b67311301db2788a06de
SHA1 b63e377dfc62599f49615488474c5d00259c7473
SHA512 1a239dcd78738dcc425931f39800c7c06a76910099ee6da92085c7f469ac6ad7e1e94030b85ef6b93209d93cb82eadfe77b81583a78f563d1c374db5e83b73a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e8772068499bbf4c2b24ca20e1f9dc6a6d724e61381fe182f7eb6ee72c7e729b
MD5 4229d27d77cff3e0495cffb7bbd1aa99
SHA1 2113e47a89298d3be939a263cb3313bfbef10bd3
SHA512 8f5910cfc121c6da4f72f74f5ab7b531a5af549990e789dfc435a67d81252f0f00471500e9dacab7d1e66fefc10c9d7370bd1d5cd2310736ebc43a1aa7263d42
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ec645f7eed9b37b502bbdd8756973e0ff6b67f5f372d7d932763c3fa0ee82062
MD5 b097807f324b56d9c565a65c95482103
SHA1 155a5d20e49c3780710409f09f136acb7448d43b
SHA512 c4b5f7a94e07bb55a3f89797e4f64d2b161e39a01791d049175fa61a66f16e6ae996e6d7f57c7328c1781ed3fa54c03117bc895efb59f3e59379d17cd5a18256
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 742694f07dad7558b83930dead11f37fa94330dc9078483c3369705d7367af3c
MD5 b0ac2dff60318f6e0407087b461f1173
SHA1 d816c17af26da534ae577517460b5a232474fd44
SHA512 4c62d6d2b11b1892882cab3d5f4ccc6dfaa20df911b6cb57932d64307ae6efc4a0c9e931ced2ef2efc790f92767506ac8c44226a5495bbcc1cdb1bf575858b7f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7d90517bc302547f9ca1b51fbc66824f8d47acd4d2b2f16749ae6d6c3fd16698
MD5 c63b6c8bfb5aaa83472f7e4cbed22e64
SHA1 fdd451a4bc1551e98f66a4fddba14dc63710b76a
SHA512 ebc1b73e75179bf136138164cbfecf85f18c32e13827de09e4998d82ec3b4343e1e679b9e03d3c0d0652fa48cd2ea22967cbb69f3ef05a05d5732bc66fdb3cfb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 38155479e8b5c1bd88bd80531f2df7642312bcafddd9e5039d91c4c6a9140339
MD5 136446efc04c33923468e6e8ea7b728b
SHA1 7125c6e9c1ba76aca0411b9e85372b55e174913d
SHA512 ec98f90f2f223720b96c605a72ce3f5c766f7382b016ea56af8ff413a62ed3219117889332ec9e159081b4e791e5723db4a610bda5cc851843a6034328b03d19
MD5 SHA1 SHA512

Submit Download

svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACCCCBABAABABABABAABBACCBBAABCACAABBCBABBAAACBCCBBCA.exe
Size 18.9MB
SHA256 2644b5894b19b156b34ac555e044390c6d0fb48c16ac64a3d94e40520652f084
MD5 9258abe1fdb9c7a63819138ebc761322
SHA1 d58fa919ca0c2c9815d82823f6e9159a794eebc5
SHA512 e8775aa0f21ca5b78ad1f6efaf7efd441e61355b3c39d55d6094b5cb17e1ca1febd2b74d97c903cfbbc68da82493c46e8bbbf2bb8a8c9a1ee8f459d4e00e0609
SSDEEP 196608:ILZJLZkLZ07APhNNECwHrc8u3x3AEcq/fByuKlWH3CTour:M3o0ahvQHrc8u3xXJ/f4uUWHW
TLSH
T116179E17F64680F6C42AD2B48A4B8337D775BC044321ABDB66D5A76A2F33BE0573A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 a31cfd673e4b92678b76b537253e3b4667403dd8fbcf7a77202506064aa4c1b4
MD5 d0154f2891ab577e136f8fa37470a03a
SHA1 632a1d1ec4f740c83e37d4e584690e2341151b94
SHA512 fe90722785bfefa1ffdbe4c3fd668e5360451699c12b597b063253ab00c3b7bc8a42cc0c60f64c00a5278d1eb6891ed9c33e8b8610290c149d38a2eea41ba95f
TLSH
T1E911C461E5F6D843F83365CBA22D9B130DE43797A89C7A58630681187FD9C35CE150E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/540-36-0x0000000000590000-0x00000000005B1000-memory.dmp

Download

memory/540-26-0x0000000000590000-0x00000000005B1000-memory.dmp

Download

memory/1072-60-0x0000000004D00000-0x0000000004D01000-memory.dmp

Download

memory/1592-89-0x0000000000590000-0x00000000005B1000-memory.dmp

Download

memory/2456-87-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/2948-0-0x00000000006E0000-0x0000000000701000-memory.dmp

Download

memory/2948-7-0x00000000006E0000-0x0000000000701000-memory.dmp

Download