3ee18148817851f9aa6c3ca61428ff6167193b4255ab0b1f54c12af7dadb6bf7

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_99cc102e5a7ee111e6a64da06db398a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 15.3MB
Sample260905-c149fsvfnd
SHA256 3ee18148817851f9aa6c3ca61428ff6167193b4255ab0b1f54c12af7dadb6bf7
MD5 99cc102e5a7ee111e6a64da06db398a3
SHA1 4551484000ae83958816ed7fc43ac52805dbb3a4
SHA512 226e3d51020cae5ea8e90bfb2d1d91948ea93bd5657bb53873ceb6b81baa6fe8956c05b3eece489aeba6d1e12759b4f6201b3b5b2f51025ca0719adb24220f39
SSDEEP 196608:s7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou5i:sahvQHrc8u3xXJ/f4uUWHH
TLSH
T130F69E13B35A81E6C06AE2B88A474312D7BA7C440334A7DF12D5B7692F77BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002458c-22.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002458c-22.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002458c-22.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
1516	svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe
1832	svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCACACABABCCCABCCBACCBBACABCCBACCABBABACAABBABBBBCCCACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe"	2026-09-04_99cc102e5a7ee111e6a64da06db398a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4704	sc.exe
2456	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3312	cmd.exe
1876	cmd.exe
4596	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_99cc102e5a7ee111e6a64da06db398a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5000	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4716	2026-09-04_99cc102e5a7ee111e6a64da06db398a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4716	2026-09-04_99cc102e5a7ee111e6a64da06db398a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4716	2026-09-04_99cc102e5a7ee111e6a64da06db398a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
4716	2026-09-04_99cc102e5a7ee111e6a64da06db398a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1516	svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe
1516	svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe
1516	svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe
1516	svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	2026-09-04_99cc102e5a7ee111e6a64da06db398a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	1516	svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4092	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 1876	4716	2026-09-04_99cc102e5a7ee111e6a64da06db398a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	96
PID 1876 wrote to memory of 5000	1876	cmd.exe	98
PID 4716 wrote to memory of 4596	4716	2026-09-04_99cc102e5a7ee111e6a64da06db398a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	99
PID 4596 wrote to memory of 2456	4596	cmd.exe	101
PID 4716 wrote to memory of 3312	4716	2026-09-04_99cc102e5a7ee111e6a64da06db398a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	102
PID 3312 wrote to memory of 4704	3312	cmd.exe	104
PID 1516 wrote to memory of 4344	1516	svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe	106
PID 4344 wrote to memory of 3664	4344	notepad.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-04_99cc102e5a7ee111e6a64da06db398a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_99cc102e5a7ee111e6a64da06db398a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACAACCAABAACBBCCBCACCCCACBCCBABAACACBACAACBCCACABCCABCBBAACBACBABCBBACACAABBCABCBCBAABBAACCACAABCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACAACCAABAACBBCCBCACCCCACBCCBABAACACBACAACBCCACABCCABCBBAACBACBABCBBACACAABBCABCBCBAABBAACCACAABCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABAABBCAABBCACCAAABCABABBAACAACBBBACCCACCACBCCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe" start= auto displayName= "UserDataSvc_BBABAABBCAABBCACCAAABCABABBAACAACBBBACCCACCACBCCCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABAABBCAABBCACCAAABCABABBAACAACBBBACCCACCACBCCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe" start= auto displayName= "UserDataSvc_BBABAABBCAABBCACCAAABCABABBAACAACBBBACCCACCACBCCCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABAABBCAABBCACCAAABCABABBAACAACBBBACCCACCACBCCCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABAABBCAABBCACCAAABCABABBAACAACBBBACCCACCACBCCCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe
1⤵
- Executes dropped EXE
PID:1832

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bb363e399ada49222e44a936ec89d898e554e202f5b2587b5a8c491adac1b1f5
MD5 7c78d5534d10e66bccfdff8a6f3f5b3c
SHA1 d411a40f4181fffb7b1e2e8884c1d39fb97936cb
SHA512 1443b3ee701783caddebec3ba64dcb30e62c4cfdb931bc78b0ba3a9958dbad58696f104f02585d8f41a0544e04d891c4fd6a992330147a8a8b521a02c808054d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 33bdbe9b20371e8fc117d8fa7c005613fb76f333e81cd93640999d4213e8ce6b
MD5 b6196cc6b8197440f133970cb95b460e
SHA1 44aef3177f5a8a2dd9a70a975fb3da2a31a94377
SHA512 00a67ecdcb69484fd9d3c16c2b01be26c4e69edf0f6906f23db7c2ad1a6f83675bbcc5afad3fa3f1cda5281d4408d608654c9e57ded6483d597a740c193fbdb9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b2e52aa1c63d0aa587b3bdd47885a034db121f567ff55c1766b4fb06c2d5eb6e
MD5 461f43fa04e12887dc83b524696425c0
SHA1 e447afab9dccfe882f6473ea554eda69cda597e5
SHA512 a17b3c24b4359ecec634fec7a97cfbe04358e48b085665d1cc09a6032b551e9bcbc5137a34476e06effafb78574452c31c6239926c14aadaf04387d694aede20
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7a01b210f9a3bb4ea581cfd867479a6afb3bb69c9da0e1848bc7975c468806ef
MD5 04dbd3fe278e9abda5a011792036ae86
SHA1 a059a40e1dd8a04f5960508a6268678292dc4bd4
SHA512 a353c320bbcb58a6256e0ece8eb9cf9e2ac87d5237b719b34a9944a0e6c5fab13c97e40347b92580e4a0d12d73a183683b8000c1f593f114cdbb86bf1520323b
MD5 SHA1 SHA512

Submit Download

svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCABABCBACBABAAACBCACBABBCCACBABAABCBBBAAABAACBCC.exe
Size 15.3MB
SHA256 3ee18148817851f9aa6c3ca61428ff6167193b4255ab0b1f54c12af7dadb6bf7
MD5 99cc102e5a7ee111e6a64da06db398a3
SHA1 4551484000ae83958816ed7fc43ac52805dbb3a4
SHA512 226e3d51020cae5ea8e90bfb2d1d91948ea93bd5657bb53873ceb6b81baa6fe8956c05b3eece489aeba6d1e12759b4f6201b3b5b2f51025ca0719adb24220f39
SSDEEP 196608:s7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTou5i:sahvQHrc8u3xXJ/f4uUWHH
TLSH
T130F69E13B35A81E6C06AE2B88A474312D7BA7C440334A7DF12D5B7692F77BE45B3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1516-27-0x0000000000530000-0x0000000000551000-memory.dmp

Download

memory/1516-40-0x0000000000530000-0x0000000000551000-memory.dmp

Download

memory/4344-68-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Download

memory/4716-0-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/4716-8-0x00000000004E0000-0x0000000000501000-memory.dmp

Download