43527d1ceaf2eba0303dfef7a5decf0a1d723e23145d32f1454b5ca8b7b79297

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 15.6MB
Sample260819-wlgdmasvbx
SHA256 43527d1ceaf2eba0303dfef7a5decf0a1d723e23145d32f1454b5ca8b7b79297
MD5 acd2c0f94afe6f2445831708efae4236
SHA1 b3c6445cca7af02e827b6de4deed410df20c99e8
SHA512 2ef2388861a984aa28e99f98ff7b65992b30463b8be34ce098a4b344e5aac97ed73f89e4acc22329088654f6f1cd508a982ccb3298f1a32d5bb5316c84675b62
SSDEEP 196608:m7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouk:mahvQHrc8u3xXJ/f4uUWHZ
TLSH
T170F69E17B35681E6C02AE2B88A474323D7B5BC440331A7DB16D5B76A2F37BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5bc-19.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5bc-19.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5bc-19.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2760	svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe
1880	svchost_CBCABABABCABABCBCCBCACAABBBCABBAACCCAABCCCCABBAABBABCAB.exe
5672	svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBACBAACBCCCBBACAAACCBBBACCBCCACAACAACABACABACAAABACACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe"	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAACBAABCBBCBCBACCBBBCACBAACAABBCBAACBCCCCBBBAABBCCCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCABABABCABABCBCCBCACAABBBCABBAACCCAABCCCCABBAABBABCAB.exe"	svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6140	sc.exe
5952	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1480	cmd.exe
4292	cmd.exe
4868	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCABABABCABABCBCCBCACAABBBCABBAACCCAABCCCCABBAABBABCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4128	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4128	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4128	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4128	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2760	svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe
2760	svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe
2760	svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe
2760	svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe
1880	svchost_CBCABABABCABABCBCCBCACAABBBCABBAACCCAABCCCCABBAABBABCAB.exe
1880	svchost_CBCABABABCABABCBCCBCACAABBBCABBAACCCAABCCCCABBAABBABCAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	2760	svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe
Token: SeDebugPrivilege	1880	svchost_CBCABABABCABABCBCCBCACAABBBCABBAACCCAABCCCCABBAABBABCAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4292	4128	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 4292 wrote to memory of 3900	4292	cmd.exe	94
PID 2760 wrote to memory of 2516	2760	svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe	95
PID 4128 wrote to memory of 4868	4128	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 4868 wrote to memory of 6140	4868	cmd.exe	100
PID 4128 wrote to memory of 1480	4128	2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	101
PID 1480 wrote to memory of 5952	1480	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_acd2c0f94afe6f2445831708efae4236_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBAAAAABABACBCAACBAACCCBBBABBCAABABBCBACCCACCAAABBBCCCCACCACCCBCBCCABCAAAABBCABACBCCCBBBABCBBBBBCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBAAAAABABACBCAACBAACCCBBBABBCAABABBCBACCCACCAAABBBCCCCACCACCCBCBCCABCAAAABBCABACBCCCBBBABCBBBBBCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACACBCAACCBCCCCCBCBBACCABABBCAAACAABCCCCCACCCCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe" start= auto displayName= "UserDataSvc_ABACACBCAACCBCCCCCBCBBACCABABBCAAACAABCCCCCACCCCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACACBCAACCBCCCCCBCBBACCABABBCAAACAABCCCCCACCCCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe" start= auto displayName= "UserDataSvc_ABACACBCAACCBCCCCCBCBBACCABABBCAAACAABCCCCCACCCCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACACBCAACCBCCCCCBCBBACCABABBCAAACAABCCCCCACCCCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACACBCAACCBCCCCCBCBBACCABABBCAAACAABCCCCCACCCCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2516

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABABABCABABCBCCBCACAABBBCABBAACCCAABCCCCABBAABBABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABABABCABABCBCCBCACAABBBCABBAACCCAABCCCCABBAABBABCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe
1⤵
- Executes dropped EXE
PID:5672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0f88cadf596f8514ca061f13a10169d5fd2c00eeb46bd3168e3cc76262606811
MD5 91cbf9939f43706b69891b7b89d8d41a
SHA1 3ee3a223a329cb1a4feb9bf60f984ecf3f018be8
SHA512 ff6192d632418d1095d607a98ee2288950d7373e613d59f1e36851680cc8e0f54524e979f84830780fab0c6f2ed4c68eb9e14c9d56fac34831d6d37d0d8cf4ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 24448ee51edfb24afbea1e4d9685542d3554c5bb9a2b31110031ca2a807d3496
MD5 98034318a6228b27b61fbff805cd422e
SHA1 ffd3f9d4679c2e8b0331fbadbd34a9c99606f761
SHA512 fcffe884fc380ed94a5f839bf2eb55cfd057060ea7f4a4ef669d86c81084f8646ecd0e12fc58cd7d0a180c760db13f901a45c76587cbae5a3bd3e0eaa87d1766
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 279b98141c85978389db3ba6383d65364cd5f5def4fc600c417e865c07d74678
MD5 b0c4494c576a9aa0cdddc529de5213e3
SHA1 90ab53306f2acb8408d1044b68a2fc226d263182
SHA512 da9853b66d25b2dee2bfa9812acb526a825c7972f4b9015bd9c2a0adea19b088c104986be72fc5aa3cbac3b6a24d569288d2c81aaca2e5536a320c194b86ff7e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 75efaa68992e5538994aa496f51170ab095d89ef243791d5a19c57c3f123682e
MD5 387ecb15a8ef1b04b52eeca37776b409
SHA1 9427b9671473ca53561511d7b5c6c63351efbfd9
SHA512 a225ed52697e0a0a1c4699114d409e57eae9701eb3ef4fead27b3330fecb916f908f65c0e0901f865bdb8ac7253c07e56906c1445651745464cc1c646fe26b14
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e07c74bb68583cac966acbec794f15d05bcc21c335ebdf48c9404f015bf82052
MD5 89aab1fae841466b672f8a0ab63d0fbb
SHA1 3ab0289c97462f51d9919231436f60b85159c575
SHA512 80e4c0632851c4ed9ac535ddff77f0a449a3b93b613418f73969cb56fae8ef860408e0bb55d14ccbba78da9d0e3daea2058cd7aba518caa9254434dfa35b725f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fc9def996fa7cca6ce324500252406542d90a29fa7f74a9817e8fdb4bad3fe1e
MD5 529bbfd4ab8bdcc8835f15467a65ea5d
SHA1 712b4e78a89fd18990a084f54f336b7205eb0bd1
SHA512 54a0b0de33dfe99de01902eff38f19ad275e21709a7c4cd77b235f138aaf72556d080822743aa3f7c1e04eea70d8d317d7eca59a5316e3c2b9b01e5a807a6227
MD5 SHA1 SHA512

Submit Download

svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAAABACCABABCCCCCAABCBBAAABAAABACCACCCCCBCABCCBACBAC.exe
Size 15.6MB
SHA256 43527d1ceaf2eba0303dfef7a5decf0a1d723e23145d32f1454b5ca8b7b79297
MD5 acd2c0f94afe6f2445831708efae4236
SHA1 b3c6445cca7af02e827b6de4deed410df20c99e8
SHA512 2ef2388861a984aa28e99f98ff7b65992b30463b8be34ce098a4b344e5aac97ed73f89e4acc22329088654f6f1cd508a982ccb3298f1a32d5bb5316c84675b62
SSDEEP 196608:m7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouk:mahvQHrc8u3xXJ/f4uUWHZ
TLSH
T170F69E17B35681E6C02AE2B88A474323D7B5BC440331A7DB16D5B76A2F37BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7a839676e0aa7e736c85fd96842a79d73f9ebaf44c8bb2a41e44b237023ae4ab
MD5 9e9bc862d14edb3baa872fecbc070154
SHA1 aff4fc735c5aab59520b55f0926d17bd9b872de8
SHA512 2eca2bebbda7809f83de71de03b5114c727331ddb393f6af13d60c33a9a9a3ffbc74f730fe1d6b7692a76791e505d7e36e434f469781452434fc8a09cc6fa62e
TLSH
T11211EB60A5A5E89BF973388A723DCA5388E03767589CEA1962494118A7D5C30CD154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1880-79-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/2760-24-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/2760-34-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/4128-0-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/4128-7-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/5672-82-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download