84aa7c6b8c31b988a21c979cd1b09b3f21b5010bb08f4dd66e01e0edf5452441

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_091d7d3fb00cb2a21b4cbf7925acea68_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 23.1MB
Sample260901-1yl7vsfa29
SHA256 84aa7c6b8c31b988a21c979cd1b09b3f21b5010bb08f4dd66e01e0edf5452441
MD5 091d7d3fb00cb2a21b4cbf7925acea68
SHA1 1fba07c701169b762b7995cbc3a2070b32d12926
SHA512 cf89c24dc5869688e002834712dcfc3bb359784eed93e3da12edc62639edba020db782014bdf8720b28106cf0cd8dec0f6028045c310cd4f9beded8369766211
SSDEEP 98304:a7777777EOU/jIEeQfoR/IuOFVjUu5BA91pH2WpjHrgBFFu416AWv7:DFIF0wuTmHpn6F44IAWv7
TLSH
T1CF376C05F98350F5D82F40B04C9BD3BBC670BD1286224BABF79DC65B6E23B906D25726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3936	svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe
3308	svchost_AAABBCBCBBBBBBCABACBCBBCCABBBCCABBABCBAACBBCCBACBBABCBA.exe
5028	svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBABCBACABACBBCABBBCAAACAACABBAAABCCABABABBBCBCBCBBBABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe"	2026-09-01_091d7d3fb00cb2a21b4cbf7925acea68_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBAACBCBCBACAAABCCCAAAABCBBBABCABABBABBABBBABBCAABCBCCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABBCBCBBBBBBCABACBCBBCCABBBCCABBABCBAACBBCCBACBBABCBA.exe"	svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4748	sc.exe
2120	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2044	cmd.exe
4936	cmd.exe
1528	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABBCBCBBBBBBCABACBCBBCCABBBCCABBABCBAACBBCCBACBBABCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_091d7d3fb00cb2a21b4cbf7925acea68_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
448	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4088	2026-09-01_091d7d3fb00cb2a21b4cbf7925acea68_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4088	2026-09-01_091d7d3fb00cb2a21b4cbf7925acea68_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4088	2026-09-01_091d7d3fb00cb2a21b4cbf7925acea68_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4088	2026-09-01_091d7d3fb00cb2a21b4cbf7925acea68_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
3936	svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe
3936	svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe
3936	svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe
3936	svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4088	2026-09-01_091d7d3fb00cb2a21b4cbf7925acea68_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	3936	svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3040	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 2044	4088	2026-09-01_091d7d3fb00cb2a21b4cbf7925acea68_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	100
PID 2044 wrote to memory of 448	2044	cmd.exe	102
PID 3936 wrote to memory of 1288	3936	svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe	104
PID 1288 wrote to memory of 3596	1288	notepad.exe	105
PID 4088 wrote to memory of 4936	4088	2026-09-01_091d7d3fb00cb2a21b4cbf7925acea68_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	107
PID 4936 wrote to memory of 2120	4936	cmd.exe	110
PID 4088 wrote to memory of 1528	4088	2026-09-01_091d7d3fb00cb2a21b4cbf7925acea68_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	111
PID 1528 wrote to memory of 4748	1528	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-09-01_091d7d3fb00cb2a21b4cbf7925acea68_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_091d7d3fb00cb2a21b4cbf7925acea68_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCAAACABCBCACBACCBACCCBCCACABACCCBBAAABBAACAACAACCCBCACCABABCACAABAABAACABAABCAABBCCCCABAAABCABBBCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCAAACABCBCACBACCBACCCBCCACABACCCBBAAABBAACAACAACCCBCACCABABCACAABAABAACABAABCAABBCCCCABAAABCABBBCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABAACCBCBCABBAAACAAACABBBBCBBABACBABCBCBBBAACCABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe" start= auto displayName= "UserDataSvc_CABAACCBCBCABBAAACAAACABBBBCBBABACBABCBCBBBAACCABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABAACCBCBCABBAAACAAACABBBBCBBABACBABCBCBBBAACCABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe" start= auto displayName= "UserDataSvc_CABAACCBCBCABBAAACAAACABBBBCBBABACBABCBCBBBAACCABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABAACCBCBCABBAAACAAACABBBBCBBABACBABCBCBBBAACCABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABAACCBCBCABBAAACAAACABBBBCBBABACBABCBCBBBAACCABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3596

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBCBBBBBBCABACBCBBCCABBBCCABBABCBAACBBCCBACBBABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBCBBBBBBCABACBCBBCCABBBCCABBABCBAACBBCCBACBBABCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe
1⤵
- Executes dropped EXE
PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 80da5faeaa625d3c6d8736f2648052e665e232e4fe393d85da4e589d4fbd2cf4
MD5 f4ea1debfea0f4ccd1f6a9336e1e022e
SHA1 2c9700c6f2f62de39a5d18f28dc83ea27c5a4fca
SHA512 eee18a066eccce3abb80fd0a3cbb0c648f0ccc0bfd07bd117e41d9a83fef75769d9929874d13b405cddfd86753e5e74d42fb812abfcf948ca9b6e17e86bd269e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 29e027990d19748ddab8c9c4c470ecbd836069e2b9fda0fba7333b346317678b
MD5 f2a71e9518fac6d85b5f827f9db36c15
SHA1 f134566536dcac59e2472268ca8badf46e2b4c3d
SHA512 707829ce353708cb9ed88240b0c58523a5d2bf8481874b6a58437164aee7ac64ec2a6397c55d491741b31158dad801b927bd84d8ba70d1abf56b81858f98de80
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 257645ade3c10f61f08e6ab25a2f22264a3ac276b57cf66befb64e62e47724ef
MD5 d6735e3c51e2a66de20b6f1d39fc1506
SHA1 10364e771187eb7be95227a17da5871dad02aaf8
SHA512 aa2c1ced808a132addae5ac80652cec1ec00995c27a01c1e69fd79a42ea78189f2184e36994563b56b5febe9da4ba67c4932b5177c0942018915d1fa88e5c87b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 efc0d891f5d365cee203f97ba2cbbddec6616060a43f3ea4fd89f05515c47d6d
MD5 85f8b4e023fb00ccf3ba374ba46dedf6
SHA1 73ac1b574609b63d774654c6efb4f4be29d37f03
SHA512 75756c101b71c1b54bea04409d5a4c227e85a5e13e39faa0b4d3e6e4f73683b59e84abb4e2d12a7745c19321a9919c623060c90d07595c4cbb3c2a14c44d3fed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 47aaff05fe78d21774297fc8ae325f7defcaf20d4912acdeeb02090f3f833b89
MD5 b62e3ac8653b1771daf6d7906c5faf3b
SHA1 c5f6ed674bad07d68d24cc4bd4b9c6ab9f6d904a
SHA512 5173de85aeaa28304f530f55d10c19a7d58fb97365a12323be439813a1d471b501766498a208e44731b9fd64c91b3378492132d08f642cf6ce7b12ba5a6467cd
MD5 SHA1 SHA512

Submit Download

svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABCCBBCAACACBCCCABACABBCAABBBBCBCCBBCCCBCCCBBCBACAB.exe
Size 23.1MB
SHA256 84aa7c6b8c31b988a21c979cd1b09b3f21b5010bb08f4dd66e01e0edf5452441
MD5 091d7d3fb00cb2a21b4cbf7925acea68
SHA1 1fba07c701169b762b7995cbc3a2070b32d12926
SHA512 cf89c24dc5869688e002834712dcfc3bb359784eed93e3da12edc62639edba020db782014bdf8720b28106cf0cd8dec0f6028045c310cd4f9beded8369766211
SSDEEP 98304:a7777777EOU/jIEeQfoR/IuOFVjUu5BA91pH2WpjHrgBFFu416AWv7:DFIF0wuTmHpn6F44IAWv7
TLSH
T1CF376C05F98350F5D82F40B04C9BD3BBC670BD1286224BABF79DC65B6E23B906D25726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1288-60-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/3936-27-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/3936-37-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/4088-0-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/4088-7-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download