20a3a7ba67ad7d5f4ccda4a30a0aa6ed2d72564cc883c1235806ab83099b9f74

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_6f77d77599c31e1da466b54ce95cff1a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Size 70.8MB
Sample260819-2mlbvsaa55
SHA256 20a3a7ba67ad7d5f4ccda4a30a0aa6ed2d72564cc883c1235806ab83099b9f74
MD5 6f77d77599c31e1da466b54ce95cff1a
SHA1 40cdb91f5c153aa208231aaf3989317e96ae0bfc
SHA512 07125607a1a5fb836869e1d62c9b2e89d6789a674e40fd7f9ddab6897f9ebb89554957d8ba3cf509420448c2bb214168e81c17645f286bb3293c1a09455576b8
SSDEEP 1572864:i33333333s6brm33333333s6brm33333333s6bro:i333333335i333333335i3333333358
TLSH
T164F7CF86B99750F8EC7EA07549ABD336C5317C378031874B66EDF6062F33A646C1A623
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
3756	svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe
3704	svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBCACBBBCABACACBBAABCBAABAACCCBABABAACABBACACBABBACBBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe"	2026-08-19_6f77d77599c31e1da466b54ce95cff1a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CACCBBBBAACCCABBCCACBACCCBCBCBACBBACBAACBABCACBBBACBBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBCCBAABBAABCCBBCACAACAACAAACAACBBCBAABBCABCCBCCAAABB.exe"	svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2956	sc.exe
2300	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1728	cmd.exe
4884	cmd.exe
2724	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_6f77d77599c31e1da466b54ce95cff1a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2316	2026-08-19_6f77d77599c31e1da466b54ce95cff1a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
2316	2026-08-19_6f77d77599c31e1da466b54ce95cff1a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
2316	2026-08-19_6f77d77599c31e1da466b54ce95cff1a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
2316	2026-08-19_6f77d77599c31e1da466b54ce95cff1a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
3756	svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe
3756	svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe
3756	svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe
3756	svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	2026-08-19_6f77d77599c31e1da466b54ce95cff1a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Token: SeDebugPrivilege	3756	svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4984	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 1728	2316	2026-08-19_6f77d77599c31e1da466b54ce95cff1a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe	94
PID 1728 wrote to memory of 1704	1728	cmd.exe	96
PID 2316 wrote to memory of 4884	2316	2026-08-19_6f77d77599c31e1da466b54ce95cff1a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe	97
PID 4884 wrote to memory of 2956	4884	cmd.exe	99
PID 2316 wrote to memory of 2724	2316	2026-08-19_6f77d77599c31e1da466b54ce95cff1a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe	100
PID 2724 wrote to memory of 2300	2724	cmd.exe	102
PID 3756 wrote to memory of 4608	3756	svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe	104
PID 4608 wrote to memory of 4164	4608	notepad.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-08-19_6f77d77599c31e1da466b54ce95cff1a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_6f77d77599c31e1da466b54ce95cff1a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCBCBACCBBAAACACCBABCBAAAACBBABBACABCACBBACACBBCBCAAAACBCBBBBACABBCBCBBCCCAACBAAABBAABBBBAABACBAAACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCBCBACCBBAAACACCBABCBAAAACBBABBACABCACBBACACBBCBCAAAACBCBBBBACABBCBCBBCCCAACBAAABBAABBBBAABACBAAACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABACBABBBCAAABACCACACAACBAAAACCBABBCBAACABCCCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe" start= auto displayName= "UserDataSvc_AAABACBABBBCAAABACCACACAACBAAAACCBABBCBAACABCCCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABACBABBBCAAABACCACACAACBAAAACCBABBCBAACABCCCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe" start= auto displayName= "UserDataSvc_AAABACBABBBCAAABACCACACAACBAAAACCBABBCBAACABCCCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABACBABBBCAAABACCACACAACBAAAACCBABBCBAACABCCCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABACBABBBCAAABACCACACAACBAAAACCBABBCBAACABCCCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2300

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4164

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBACABBCCABCCCACCBABCCACCABCBCAAACAABBCAABBAABBBACB.exe
1⤵
- Executes dropped EXE
PID:3704

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9637d17cdd2d9b5c28e24336440d4d20493f67f67b56158c036a3dac39d776bb
MD5 67c2656e87de19163ea17d8420412892
SHA1 fa4fbd72676060b04579899c7cf141dbe2882bf0
SHA512 bcbeabf68355b5300397cf2f62113ed1b7396bddb1769c3e6e2febb0913c91079d9dfb2c02500cf191e0dbab4b70e1be797fd1913a82a8d3c490fb4f667c83ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7fb420fe73c2cb02ba3e474ab44333f88b068ab074356c9ccca60af73e982c80
MD5 3df6be4d869e254c2109b10f0820f15c
SHA1 7f44141adefac99f48630ae71a3b63eaaafa95f3
SHA512 49d65b88f87affd97141037efc39cf322d174f90d3998968f6bbe3aba2b93124049ad45bd36fbe43c6f4d28f77e64d43d93abcf0e395f7ddb44703d2761e5c8b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4242b3cd9e45d78bd769ce75091e3a3f85eeb92e50b97ced5238acd4a4946628
MD5 8767170d2150daca28d7ccc1eb039d87
SHA1 15c052f98b1a712b95982309a8cf33d33beb93c7
SHA512 205d4807f89d5d0fff3cb359f723e4fffaf819b606e977fb54b08328a874b64b75f7ee8d09e1747464adbd39053916d6ac82e75620a1fe79bccc1db76ad60ba1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 68e8e9f60ead13ed00be8b884215f509f201f1720ddd386a6d8c0d6a9ab7eab5
MD5 cc73538946e0558af3f75a7ee13ce906
SHA1 9b049c7a1bceb634f5258e26fc9fcf5ab07d029e
SHA512 71befd28aea43e33c2a62f7a2b08aa50a3fcde0390d0e21515a1b62264ba6f3091f453043eab7732260107956cf6c1b32611271fbaceac9855de9390d4665806
MD5 SHA1 SHA512

Submit Download

memory/2316-0-0x0000000000030000-0x0000000000051000-memory.dmp

Download

memory/2316-8-0x0000000000030000-0x0000000000051000-memory.dmp

Download

memory/3756-27-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/3756-40-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/4608-68-0x00000000013E0000-0x00000000013E1000-memory.dmp

Download