8e7ad7bccc94200edb20c4d4fa7bba5d756ccff0972cf999aa931569951387e1

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_f864e037a568c4c24dd03ad32604b5fc_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 15.4MB
Sample260819-ebct1scg79
SHA256 8e7ad7bccc94200edb20c4d4fa7bba5d756ccff0972cf999aa931569951387e1
MD5 f864e037a568c4c24dd03ad32604b5fc
SHA1 c5a73d5002eaf3c047adae3c4121f447e4f6ff13
SHA512 9e40274632755717871f5190c382ae340691310f2c0ae8f966b8228ebcd6fff8097b27fc6d78ccdec3c1e52439088f26239de6ebb6dfb491206c051fd7ab487e
SSDEEP 196608:vvy7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouN:SahvQHrc8u3xXJ/f4uUWHo
TLSH
T14FF69D17B35A81E6C02AD2B886474216D7B57C440331ABDB12E4BB6D3F77BE45B3A360
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5f7-20.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5f7-20.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5f7-20.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
5944	svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCABAACCAABABCBACBACACBCBCABCCAACABCBABBAACCBBCBCBAAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe"	2026-08-19_f864e037a568c4c24dd03ad32604b5fc_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5520	sc.exe
5872	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3520	cmd.exe
2064	cmd.exe
4100	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_f864e037a568c4c24dd03ad32604b5fc_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2868	2026-08-19_f864e037a568c4c24dd03ad32604b5fc_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2868	2026-08-19_f864e037a568c4c24dd03ad32604b5fc_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2868	2026-08-19_f864e037a568c4c24dd03ad32604b5fc_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2868	2026-08-19_f864e037a568c4c24dd03ad32604b5fc_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5944	svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe
5944	svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	2026-08-19_f864e037a568c4c24dd03ad32604b5fc_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	5944	svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3520	2868	2026-08-19_f864e037a568c4c24dd03ad32604b5fc_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 3520 wrote to memory of 5100	3520	cmd.exe	94
PID 2868 wrote to memory of 2064	2868	2026-08-19_f864e037a568c4c24dd03ad32604b5fc_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	95
PID 2064 wrote to memory of 5520	2064	cmd.exe	97
PID 2868 wrote to memory of 4100	2868	2026-08-19_f864e037a568c4c24dd03ad32604b5fc_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-19_f864e037a568c4c24dd03ad32604b5fc_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_f864e037a568c4c24dd03ad32604b5fc_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABCCCBCCCBACABACBBAAACACBCCBBCACCAACABBABBCBCCCACACBBBABABABAABACAACBCCCBBBBACCBCBBBCACACBCBCCCBBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABCCCBCCCBACABACBBAAACACBCCBBCACCAACABBABBCBCCCACACBBBABABABAABACAACBCCCBBBBACCBCBBBCACACBCBCCCBBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABBAABBCBBCBBBACCACBBCBBBBCBBBCCCBBCCACAACCCACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe" start= auto displayName= "UserDataSvc_CCABBAABBCBBCBBBACCACBBCBBBBCBBBCCCBBCCACAACCCACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABBAABBCBBCBBBACCACBBCBBBBCBBBCCCBBCCACAACCCACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe" start= auto displayName= "UserDataSvc_CCABBAABBCBBCBBBACCACBBCBBBBCBBBCCCBBCCACAACCCACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABBAABBCBBCBBBACCACBBCBBBBCBBBCCCBBCCACAACCCACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4100
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABBAABBCBBCBBBACCACBBCBBBBCBBBCCCBBCCACAACCCACCBB"
    3⤵
    - Launches sc.exe
    PID:5872

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5944

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe
1⤵
PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b3e6590d367c97531daf64034939c1e3700a785b8ea2e3beab20a8f79c88d95d
MD5 c2c53ab2f481adcc512d565812ddda15
SHA1 607f2a4e0e133be59c3ab95e737b141c9d8e4b0e
SHA512 6ac711580c848b0ccb43be619c8ff7c4034116c849a7b6c32b85f237236f09dfaec63756fe87004c62b20fb0ed835cd16cbe866d3476448691266756f3e8a1b1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 52cd814ed9041230521a85ea7a969e0c727c2ff5a78a1ab9ae70e3b8a9071065
MD5 2639cf8f79a29410860862939f2bb91d
SHA1 317203f9cabcff36952d99b5b53a858fee3aa795
SHA512 fabe5d989d7693d4f6bccb753d57c7bd764b72c2077e6b18b7b2d745a644f7d5adb48861d71105f6c22032c2612107658dcf0919649b4878287d50e1d9be1520
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b0199d8200ce3b4169f5ad7eba2d1fba1ef7cef4a9ce836633d2bee6ee1dba59
MD5 95a43f2e2549843465aa3ccce6cc04f5
SHA1 0f4d76207f275f7664ebf841aba2b14f49e8c974
SHA512 5ab5f1403a5dee23ad97111ebfbfb73fee2c2cff956eaec385c983d88058646166cc39b565166308d480feab08e97b73a9e4634353378a351dc73132af12f9c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ebe9c6ea367e38993c5c6553e53a3a0643308f62161a7cbb2d6d41dad1763d62
MD5 d849855938d490210f5361f980325123
SHA1 e9a7419c7c3c846a164f3d4505d55076ab63ddf5
SHA512 4a650cc82b4f684d5eab07247b3ea564b3b7dc02a13f5a57fab76ccc77ac3010310dd9c15856348daad052286a38d121d65e8cca9ee2fe7c7ef540391627d302
MD5 SHA1 SHA512

Submit Download

svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe
Size 15.4MB
SHA256 8e7ad7bccc94200edb20c4d4fa7bba5d756ccff0972cf999aa931569951387e1
MD5 f864e037a568c4c24dd03ad32604b5fc
SHA1 c5a73d5002eaf3c047adae3c4121f447e4f6ff13
SHA512 9e40274632755717871f5190c382ae340691310f2c0ae8f966b8228ebcd6fff8097b27fc6d78ccdec3c1e52439088f26239de6ebb6dfb491206c051fd7ab487e
SSDEEP 196608:vvy7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouN:SahvQHrc8u3xXJ/f4uUWHo
TLSH
T14FF69D17B35A81E6C02AD2B886474216D7B57C440331ABDB12E4BB6D3F77BE45B3A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACBCABCBCCCCCAABBACBCAAABBCAACCBAABACCBCBACCACBBB.exe
Size 2.5MB
SHA256 002f2f4e55bcb3aafa4b11808c97074306b8c70e2804f82586e8ad391acf3ef4
MD5 baebffa26ac7cac0c9b6625b059162a3
SHA1 58480460061289560c83f99f59e133aeecec68fe
SHA512 3e9982a524e9919eb319d3c8b7ac951703f0c687b89e6e4c464868914c07867994b3f5d780a47d3550a9717b3a487689474a29e6f478d8b0a9f1b153ec5a1017
SSDEEP 49152:U+Eevy6i1zuajsauZvMlPhwc7Ue8j2f+K3ZCQgzIhNFjGcVuknKu:vvtw7Upmp
TLSH
T1FCC54A07A29900F8D069C1788756912AEA71B4558733BDDF06908EFD7FA7EE05B39B30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2868-0-0x0000000000AD0000-0x0000000000AF1000-memory.dmp

Download

memory/2868-8-0x0000000000AD0000-0x0000000000AF1000-memory.dmp

Download

memory/5944-25-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download

memory/5944-38-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download