d3ce16a20a65489c67d7e56a63d537311a0d4843d11ed360c33e64606ac846cc

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_f26a90ec9fff0a96fb884941b0c13730_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Size 15.4MB
Sample260823-s9phcsaf79
SHA256 d3ce16a20a65489c67d7e56a63d537311a0d4843d11ed360c33e64606ac846cc
MD5 f26a90ec9fff0a96fb884941b0c13730
SHA1 0b9cf7859acffa71961b381059c49920bdd7689a
SHA512 e386c1abc582b0487beaf25ba159352759a05b28e5e8ccbf509f1b59d4378187e321039d2987dc0ed0597453a28f2b0972a18e46892f5e630058684feb89c862
SSDEEP 196608:Z7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouT:ZahvQHrc8u3xXJ/f4uUWHi
TLSH
T11FF69E17B35681E6C02AE2B88A474323D7B5BC440334A7DB16D5B76A2F37BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c557-18.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c557-18.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c557-18.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1084	svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe
6072	svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe
2532	svchost_CCABBCABBAABACBABBCCCCBABCCCCCBBBCBBBAABBAACCBCAAACABAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBBACACAAACBAABABABCCABBABCAAAABABCCABBACBAACCABCABABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe"	2026-08-23_f26a90ec9fff0a96fb884941b0c13730_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBABCAACCAABCACBACBBAAAAACBBBAABCBCBABAAAAAAAAAABACACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABBCABBAABACBABBCCCCBABCCCCCBBBCBBBAABBAACCBCAAACABAA.exe"	svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4532	sc.exe
3060	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4408	cmd.exe
2436	cmd.exe
2084	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABBCABBAABACBABBCCCCBABCCCCCBBBCBBBAABBAACCBCAAACABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_f26a90ec9fff0a96fb884941b0c13730_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1296	2026-08-23_f26a90ec9fff0a96fb884941b0c13730_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
1296	2026-08-23_f26a90ec9fff0a96fb884941b0c13730_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
1296	2026-08-23_f26a90ec9fff0a96fb884941b0c13730_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
1296	2026-08-23_f26a90ec9fff0a96fb884941b0c13730_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
1084	svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe
1084	svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe
1084	svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe
1084	svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1296	2026-08-23_f26a90ec9fff0a96fb884941b0c13730_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Token: SeDebugPrivilege	1084	svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 4408	1296	2026-08-23_f26a90ec9fff0a96fb884941b0c13730_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	91
PID 4408 wrote to memory of 1788	4408	cmd.exe	93
PID 1296 wrote to memory of 2436	1296	2026-08-23_f26a90ec9fff0a96fb884941b0c13730_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	94
PID 2436 wrote to memory of 4532	2436	cmd.exe	96
PID 1296 wrote to memory of 2084	1296	2026-08-23_f26a90ec9fff0a96fb884941b0c13730_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	97
PID 2084 wrote to memory of 3060	2084	cmd.exe	99
PID 1084 wrote to memory of 5544	1084	svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-23_f26a90ec9fff0a96fb884941b0c13730_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_f26a90ec9fff0a96fb884941b0c13730_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCCBAABCCBACBABABACBBCABABBABBAACABABCACCABACBBABAAABBBACAAABACACBBBCCCBAACABABCABCBAACBCAACCBCBCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCCBAABCCBACBABABACBBCABABBABBAACABABCACCABACBBABAAABBBACAAABACACBBBCCCBAACABABCABCBAACBCAACCBCBCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABCCCBABBAABCBAACABCBBABCCAACBBACCBBACBBCABCACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe" start= auto displayName= "UserDataSvc_BCABCCCBABBAABCBAACABCBBABCCAACBBACCBBACBBCABCACBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABCCCBABBAABCBAACABCBBABCCAACBBACCBBACBBCABCACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe" start= auto displayName= "UserDataSvc_BCABCCCBABBAABCBAACABCBBABCCAACBBACCBBACBBCABCACBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABCCCBABBAABCBAACABCBBABCCAACBBACCBBACBBCABCACBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABCCCBABBAABCBAACABCBBABCCAACBBACCBBACBBCABCACBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5544

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe
1⤵
- Executes dropped EXE
PID:6072

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBCABBAABACBABBCCCCBABCCCCCBBBCBBBAABBAACCBCAAACABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBCABBAABACBABBCCCCBABCCCCCBBBCBBBAABBAACCBCAAACABAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7abf4cfa0542b2327f67ef9a3716cf837e9552d78ec583c96c5b5d71853886ec
MD5 25962a9f8dcaf1150a2435f17c3e89c4
SHA1 1efcc23514cfca70503ca61e76a549ff9fa36a0b
SHA512 08ab9ac00bbf7d8a3dc3f5c0fadc606a7406f2c135bc3fceccea02d30be5bc060860773739278f18ca0e70b4a05e32c5287eb716da7d9b0d8cc77d3af29d7640
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f38f82a66340a68db32afa47cf1e0048421468b3210dfcd0a7ca86aedf6f88e3
MD5 f38acb6ec06de09e8bca3f1d4a0ae700
SHA1 b8d58eee8dba5f1686785df3a65ed50dacc17ab6
SHA512 6df44b1b521cceba3dc3cdf1ff45458a68b6b8dcdb0371cab461d9999210aa128279553daaf24f68893af8ff6f8ceb50c083f0745d7cc7a72034e84165c73181
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bc9f88bad78dc3758d0d39b6e7d9edc9f7b0b0f641b9dd812628992db8d574b0
MD5 2a185fa90cb2f337eb5519e2cca501fa
SHA1 15779ff34a88c8fa9ef43c9d372c9b9b5ad45ff9
SHA512 206e416f315ac22d734395f581430782957e4db99a20037e99c1d093cfb368fd6df3cfa22946bf844f59a5d766a54e9be6d5e57c91ced14136e415f02152de9a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7b8e7a1c6e1875a20eaa4e6659f4c6e565e7702e3586987595160934e045d08d
MD5 053170959e6bd2e93da07879f5659852
SHA1 aeae5e49da88125e3e6d7feaebacb0dbc50829f6
SHA512 debdbad4ab602609dec0a8a5bdfd214707e36234ae2ebadc4337a4730d042da29e815de62d740056368bc0fafe1671135b7289985be99abd6399732903b0233c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9000c72ebb6ad8b990d2d72a27ab812d9f62ddf1e976ceddb49edf716ca48f26
MD5 03367fe0b60ecc425198ebd11d3214b1
SHA1 0628041496e042305c9c2b61ef85be6ba0eebacb
SHA512 1c3c0544c7e8f45512745ba9d58874f059ac8a0bf9bca23fba315ab63e911f55143f2ef1938c54c774907a4f86cd650d3aa8e913b7b20afc212b7b7f39ac39ab
MD5 SHA1 SHA512

Submit Download

svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBBACACBCCCBCAACCBAACACBBCBBBCACBBACBCCBAACACAA.exe
Size 15.4MB
SHA256 d3ce16a20a65489c67d7e56a63d537311a0d4843d11ed360c33e64606ac846cc
MD5 f26a90ec9fff0a96fb884941b0c13730
SHA1 0b9cf7859acffa71961b381059c49920bdd7689a
SHA512 e386c1abc582b0487beaf25ba159352759a05b28e5e8ccbf509f1b59d4378187e321039d2987dc0ed0597453a28f2b0972a18e46892f5e630058684feb89c862
SSDEEP 196608:Z7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouT:ZahvQHrc8u3xXJ/f4uUWHi
TLSH
T11FF69E17B35681E6C02AE2B88A474323D7B5BC440334A7DB16D5B76A2F37BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1084-22-0x0000000000030000-0x0000000000051000-memory.dmp

Download

memory/1084-35-0x0000000000030000-0x0000000000051000-memory.dmp

Download

memory/1296-6-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/2532-74-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download

memory/6072-65-0x0000000000030000-0x0000000000051000-memory.dmp

Download