8263a08863d19354cc49c705abced2be61b5b1b843c8caf8a8a0a93cb1fc5429

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 18:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_3bb556a4c17d55fe14a90dfa8a087b3f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 15.0MB
Sample260828-wx2hya1xdv
SHA256 8263a08863d19354cc49c705abced2be61b5b1b843c8caf8a8a0a93cb1fc5429
MD5 3bb556a4c17d55fe14a90dfa8a087b3f
SHA1 e6c00df6351695ae51312adcfbe5397a820b7e67
SHA512 9628760cacef6522a1c2cbc46d24561caf86358e44704ea2334cdfb817a9d8e44914e21fdc3951e24acd9cc02623937285885294b70b7064d9c0ed1b52f9a681
SSDEEP 196608:N7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou+:NahvQHrc8u3xXJ/f4uUWHf
TLSH
T150F69D17B35A81E6C02AE2B88A474212E7B9BC440330B7DB16D5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c44f-20.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c44f-20.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c44f-20.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3492	svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe
2956	svchost_CCBCAABCCACCBCBACBAACABAABBBBCCCCABCBABBACCAABCABABBCBA.exe
2324	svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABBBACAAACBCCBCBCAAABACBABBBCCCCBACCABBCCAABAABCACCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe"	2026-08-28_3bb556a4c17d55fe14a90dfa8a087b3f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAABBBBCBCBACCBAACACCAAAABCCBBABAAAACBABBBBABCBBBBAAAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCAABCCACCBCBACBAACABAABBBBCCCCABCBABBACCAABCABABBCBA.exe"	svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2152	sc.exe
2444	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1036	cmd.exe
3636	cmd.exe
3428	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_3bb556a4c17d55fe14a90dfa8a087b3f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCAABCCACCBCBACBAACABAABBBBCCCCABCBABBACCAABCABABBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2800	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4284	2026-08-28_3bb556a4c17d55fe14a90dfa8a087b3f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4284	2026-08-28_3bb556a4c17d55fe14a90dfa8a087b3f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4284	2026-08-28_3bb556a4c17d55fe14a90dfa8a087b3f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4284	2026-08-28_3bb556a4c17d55fe14a90dfa8a087b3f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
3492	svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe
3492	svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe
3492	svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe
3492	svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4284	2026-08-28_3bb556a4c17d55fe14a90dfa8a087b3f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	3492	svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 3636	4284	2026-08-28_3bb556a4c17d55fe14a90dfa8a087b3f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	92
PID 3636 wrote to memory of 2800	3636	cmd.exe	94
PID 3492 wrote to memory of 3524	3492	svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe	95
PID 4284 wrote to memory of 3428	4284	2026-08-28_3bb556a4c17d55fe14a90dfa8a087b3f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	98
PID 3428 wrote to memory of 2152	3428	cmd.exe	100
PID 4284 wrote to memory of 1036	4284	2026-08-28_3bb556a4c17d55fe14a90dfa8a087b3f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	101
PID 1036 wrote to memory of 2444	1036	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-28_3bb556a4c17d55fe14a90dfa8a087b3f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_3bb556a4c17d55fe14a90dfa8a087b3f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBAACBCBCBCAACAAACABCBBCABAACCBBCAACCABAAAAABCCCCCCBCBABAAABCCCBBBAACAAABBBBABCBABACCCBBCABACABBCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBAACBCBCBCAACAAACABCBBCABAACCBBCAACCABAAAAABCCCCCCBCBABAAABCCCBBBAACAAABBBBABCBABACCCBBCABACABBCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCABCBCCBCCACACCCABCCCACCACAACACAAABCAABCCBCCCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe" start= auto displayName= "UserDataSvc_ACBCABCBCCBCCACACCCABCCCACCACAACACAAABCAABCCBCCCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCABCBCCBCCACACCCABCCCACCACAACACAAABCAABCCBCCCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe" start= auto displayName= "UserDataSvc_ACBCABCBCCBCCACACCCABCCCACCACAACACAAABCAABCCBCCCBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCABCBCCBCCACACCCABCCCACCACAACACAAABCAABCCBCCCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCABCBCCBCCACACCCABCCCACCACAACACAAABCAABCCBCCCBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3524

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABCCACCBCBACBAACABAABBBBCCCCABCBABBACCAABCABABBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABCCACCBCBACBAACABAABBBBCCCCABCBABBACCAABCABABBCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe
1⤵
- Executes dropped EXE
PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3689d97d670d3275a8fea7747b92ec35ac6e1f772c7821c0b48b6d72dafc5daf
MD5 eb5db1430f1d85b388844ecf2d503168
SHA1 eaf12245a4ff3eed5513fa30e7beb97ab42df51c
SHA512 847d6cc91b763ba3f2253bffc583fd96a40a99014f5a433b98b55d2a28fc80684055ab0084e4a0eba115d3b52186024e2e8329fc7b1d220dc7dc59ec2f405bbd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 42b80d287dcfca70ad4d458ed8e428d8d580e2702b18f99a204d2154038e452b
MD5 0840f129ef66e3d89873e5768ae559cc
SHA1 45c4c7371b8c5ab818047812eedeb1282ac7e42d
SHA512 857b84880fe5801f3d4513b8a1de2004871a4d4c188d8a2367c2aaf68ec794846443e84bc855d732b51b9d505ac866cb6f3e22ee2a7ce45f33148057e1723c6d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eaa8c8678d2e9deb8dd0d770899e9714456d112ce04171e7addfd44a0a5cf869
MD5 34e6b9e2c759ff6d58d04b927f4edf1f
SHA1 f0cae60a8920276a418b381b65a101ad93b59013
SHA512 23e4b66ac2b5b05be5bca13d0f07c3f756ca59b153f0cd2234b59d60c54560c3b07cc4324ba954dcd0d4412d17ba9ea3921e941f4457a030235afa45e4c852eb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2c1751b2f6d3f010c5eae8f31b68f55c8a889246b5682c2f109c713460f09f3b
MD5 5e5b56b251fbd71ddd5ab06e582249ec
SHA1 d7841413ebced9e171af2f77a7f1f059a4ee5b98
SHA512 6f87817f879fbfe82cb56669580969dbd385031b13f857267fa28f6a4027fdd6047311eef8df1c46b5e16a14d1a22ba23b84c4a3e420733d8c0ee9c9dba558e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 197141f3f0e185817dbaf8e82826542e37b89a5d69f0a693cd5f4d6c75da6e0a
MD5 7a08c1d4ffab7772c195114e76635e8c
SHA1 c68514d113b292505a9b5719f9bd2e10f71d534b
SHA512 b94a2e5836c983ed180311a1140079323a9d03f85af621444e493933ddbb65ef0eb40ece64158ea952c608916ca9d5076bb17bc9aa2c1ad9bbeabad659efe4ec
MD5 SHA1 SHA512

Submit Download

svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBACBBACCAABBCCBBBACCACBCCAABBBCBCCACBBABCBBCCACCCCCB.exe
Size 15.0MB
SHA256 8263a08863d19354cc49c705abced2be61b5b1b843c8caf8a8a0a93cb1fc5429
MD5 3bb556a4c17d55fe14a90dfa8a087b3f
SHA1 e6c00df6351695ae51312adcfbe5397a820b7e67
SHA512 9628760cacef6522a1c2cbc46d24561caf86358e44704ea2334cdfb817a9d8e44914e21fdc3951e24acd9cc02623937285885294b70b7064d9c0ed1b52f9a681
SSDEEP 196608:N7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou+:NahvQHrc8u3xXJ/f4uUWHf
TLSH
T150F69D17B35A81E6C02AE2B88A474212E7B9BC440330B7DB16D5B7692F77BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2956-70-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download

memory/3492-24-0x00000000004A0000-0x00000000004C1000-memory.dmp

Download

memory/3492-34-0x00000000004A0000-0x00000000004C1000-memory.dmp

Download

memory/4284-0-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/4284-8-0x0000000000480000-0x00000000004A1000-memory.dmp

Download