568707c7de261de39602d6128abc35a06cf6ad55c3bf40cafc0455b1bd6f9015

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_9b8318501694a427aef987b15c8937f5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 21.2MB
Sample260826-tfrlassapb
SHA256 568707c7de261de39602d6128abc35a06cf6ad55c3bf40cafc0455b1bd6f9015
MD5 9b8318501694a427aef987b15c8937f5
SHA1 05ba9a058345536d010446481604940905ced66c
SHA512 f689f8191fc64bacf379140d79af7c25318c55b9078a93640d64ef5764d875de78c3f6a4741398127c103d74d3f36ea989f974910d6b586f179e978112f2a92e
SSDEEP 196608:k7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToum:kahvQHrc8u3xXJ/f4uUWH7
TLSH
T173279D06F64740F1C42BD1B4898B837BC775BD144321ABEBE699A75A2F33BE0563A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c611-20.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c611-20.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c611-20.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3260	svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe
6756	svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe
4700	svchost_BCCBCBACCAACACAACACAAACCCCACBBCBAACCCBACACCCAAACCABCABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBBACAACCCCCCBCCCCAABCABACACCCAACCBACCBABABBCAAAACCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe"	2026-08-25_9b8318501694a427aef987b15c8937f5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACCBACCBCABBCCCABAACACBBBCCABBCCBACCBBAACBBABBABABBCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBCBACCAACACAACACAAACCCCACBBCBAACCCBACACCCAAACCABCABA.exe"	svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2836	sc.exe
1964	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7164	cmd.exe
3732	cmd.exe
2760	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_9b8318501694a427aef987b15c8937f5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBCBACCAACACAACACAAACCCCACBBCBAACCCBACACCCAAACCABCABA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5220	2026-08-25_9b8318501694a427aef987b15c8937f5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5220	2026-08-25_9b8318501694a427aef987b15c8937f5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5220	2026-08-25_9b8318501694a427aef987b15c8937f5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
5220	2026-08-25_9b8318501694a427aef987b15c8937f5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
3260	svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe
3260	svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe
3260	svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe
3260	svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5220	2026-08-25_9b8318501694a427aef987b15c8937f5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	3260	svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5220 wrote to memory of 7164	5220	2026-08-25_9b8318501694a427aef987b15c8937f5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	94
PID 7164 wrote to memory of 3816	7164	cmd.exe	96
PID 5220 wrote to memory of 3732	5220	2026-08-25_9b8318501694a427aef987b15c8937f5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	97
PID 3732 wrote to memory of 2836	3732	cmd.exe	99
PID 3260 wrote to memory of 2320	3260	svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe	100
PID 5220 wrote to memory of 2760	5220	2026-08-25_9b8318501694a427aef987b15c8937f5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	101
PID 2760 wrote to memory of 1964	2760	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-25_9b8318501694a427aef987b15c8937f5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_9b8318501694a427aef987b15c8937f5_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABAABBACBCACBCCBBACCBBBCABBBCCBBCCCAABCACAAAACBBBBAABBCBBACCBACCCABBBBBCACBBABBAACABBACACCABCABCBBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:7164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABAABBACBCACBCCBBACCBBBCABBBCCBBCCCAABCACAAAACBBBBAABBCBBACCBACCCABBBBBCACBBABBAACABBACACCABCABCBBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCBACCCCBBABBCBABCBCCCCCBABABCACBCABABCBBCBCCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe" start= auto displayName= "UserDataSvc_ACCCBACCCCBBABBCBABCBCCCCCBABABCACBCABABCBBCBCCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCBACCCCBBABBCBABCBCCCCCBABABCACBCABABCBBCBCCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe" start= auto displayName= "UserDataSvc_ACCCBACCCCBBABBCBABCBCCCCCBABABCACBCABABCBBCBCCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCBACCCCBBABBCBABCBCCCCCBABABCACBCABABCBBCBCCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCBACCCCBBABBCBABCBCCCCCBABABCACBCABABCBBCBCCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1964

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2320

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe
1⤵
- Executes dropped EXE
PID:6756

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBACCAACACAACACAAACCCCACBBCBAACCCBACACCCAAACCABCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBACCAACACAACACAAACCCCACBBCBAACCCBACACCCAAACCABCABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa843b845e298610c96429ab2fc5f9203a26aae0601bd0dcccbfb0bfc9b44c9f
MD5 ee7b749a68b392d17dd2bce26ee11159
SHA1 3bddf214bc5d644c1785a42f097b07535c9406bc
SHA512 16eb129e7ce3f6e8df44f1277f19ab2965694abb5d6d98d3aac979ff37bb0583fc2ea4ef65e710c77073c68a9f420589993243b7b65fc48ca12b4f8aac52f704
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8133e50feffdad6b8c50bdebee45b437cfb6c509d1c862c1d3ba610769d79ba5
MD5 13f2595e6200014bdb8987e775210b6b
SHA1 5fe53e39e86e5de831879bd2f85818008d7caf6c
SHA512 8bf8284f8710ef21ca039460c4f690be1d3d45f85e3beee35b3b04a3b75fc2ef6288eba62bac4c3bc766555b5f6c5f65830936a0252b0236095f0fcabe485d11
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 583ff371b5f1159187d78c5441494192a178477d32eb4dbc62ab4c3a724f4988
MD5 4dce50ddd94650cf2d00840a66b8054c
SHA1 2c9a4c6a0242e4cf9226e430e167d3db90ffee62
SHA512 a722af3cf450ad13697a322f3fe269f2b250a73387b6e7d12f024e1f39f55eddd21e9dfd8ff5965a47e69bd43fb18509bf02eeb79ba238e597176de766c0c72f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e99965cff5c24897d30506c98df4558ea28d89ac30138ac56ec4d36086b2536d
MD5 98dfc0b3fdefd95c48a86dd61fe882db
SHA1 148e7ddc5aa16cbfd8f1ac840875bb748c295ae6
SHA512 4cfad7ae7f1c0c3763c4e4f540d5b7294edd1fa63270a2d9f1f0e9ce2ba20afd0abae05ddf080643acfb73df920aefa2213e621336008a8ab0052857dc8bbe33
MD5 SHA1 SHA512

Submit Download

svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBCBBCCBACBCBCBCBCBCACACBCCBCCCBCCCBBABCCABACCCCCA.exe
Size 21.2MB
SHA256 568707c7de261de39602d6128abc35a06cf6ad55c3bf40cafc0455b1bd6f9015
MD5 9b8318501694a427aef987b15c8937f5
SHA1 05ba9a058345536d010446481604940905ced66c
SHA512 f689f8191fc64bacf379140d79af7c25318c55b9078a93640d64ef5764d875de78c3f6a4741398127c103d74d3f36ea989f974910d6b586f179e978112f2a92e
SSDEEP 196608:k7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToum:kahvQHrc8u3xXJ/f4uUWH7
TLSH
T173279D06F64740F1C42BD1B4898B837BC775BD144321ABEBE699A75A2F33BE0563A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3260-24-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/3260-37-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/5220-0-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/5220-7-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download