16f44762c26155ab5fdcfd167c5407723559a26e498d2322a330fa186b28f7c8

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/09/2026, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_c830bf06accddd4cc8759e7301dfc89a_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
Size 60.3MB
Sample260906-wrvs7sel2t
SHA256 16f44762c26155ab5fdcfd167c5407723559a26e498d2322a330fa186b28f7c8
MD5 c830bf06accddd4cc8759e7301dfc89a
SHA1 8c5a9c3bcd1c710a41a9fdd66f11a5630e6509ab
SHA512 14308e265641af5300a6abaf867b94fcd42022a2c6e22fb2af2bf63303d1a0dac326ec20d9c14fdd9ec31d1e23c6c10f87a99379b68a4d39e970a72f3979d068
SSDEEP 786432:1vQHrK5/f4uUhvQHrK5/f4uUhvQHrK5/f4uUhvQHrK5/f4uUYEIv0:1vQHW2XvQHW2XvQHW2XvQHW2C0
TLSH
T111D79E17B35A81E6C02AE2B88A474212D7BA7C440334B7DB12D5B7692F77BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3576	svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe
3296	svchost_AAABAACAACAACABACBCAAABBBCAACABAABBBAACACBBBAACBCCCBCAC.exe
3608	svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAACCABCCACBCBCAACBBABABACCCCBBAABAAACAAAABCABCCAAABABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe"	2026-09-06_c830bf06accddd4cc8759e7301dfc89a_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBCACBCABCAACACABBCABCACAACABCBABBCCCCCBCBBBBCAABACBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABAACAACAACABACBCAAABBBCAACABAABBBAACACBBBAACBCCCBCAC.exe"	svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4548	sc.exe
4820	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2604	cmd.exe
4084	cmd.exe
4560	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_c830bf06accddd4cc8759e7301dfc89a_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABAACAACAACABACBCAAABBBCAACABAABBBAACACBBBAACBCCCBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
212	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1080	2026-09-06_c830bf06accddd4cc8759e7301dfc89a_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
1080	2026-09-06_c830bf06accddd4cc8759e7301dfc89a_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
1080	2026-09-06_c830bf06accddd4cc8759e7301dfc89a_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
1080	2026-09-06_c830bf06accddd4cc8759e7301dfc89a_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
3576	svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe
3576	svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe
3576	svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe
3576	svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe
3296	svchost_AAABAACAACAACABACBCAAABBBCAACABAABBBAACACBBBAACBCCCBCAC.exe
3296	svchost_AAABAACAACAACABACBCAAABBBCAACABAABBBAACACBBBAACBCCCBCAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	2026-09-06_c830bf06accddd4cc8759e7301dfc89a_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
Token: SeDebugPrivilege	3576	svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe
Token: SeDebugPrivilege	3296	svchost_AAABAACAACAACABACBCAAABBBCAACABAABBBAACACBBBAACBCCCBCAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1860	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2604	1080	2026-09-06_c830bf06accddd4cc8759e7301dfc89a_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe	109
PID 2604 wrote to memory of 212	2604	cmd.exe	111
PID 3576 wrote to memory of 3952	3576	svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe	112
PID 3952 wrote to memory of 4160	3952	notepad.exe	113
PID 1080 wrote to memory of 4084	1080	2026-09-06_c830bf06accddd4cc8759e7301dfc89a_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe	117
PID 4084 wrote to memory of 4548	4084	cmd.exe	119
PID 1080 wrote to memory of 4560	1080	2026-09-06_c830bf06accddd4cc8759e7301dfc89a_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe	120
PID 4560 wrote to memory of 4820	4560	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-09-06_c830bf06accddd4cc8759e7301dfc89a_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_c830bf06accddd4cc8759e7301dfc89a_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACCBCBACCABBAACBABAABAABCABACACCCCCCBAACBCCBCBABBCABABBABAAAACCCACCAACBBBCABCAACCBBBCACCCCABBABBBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACCBCBACCABBAACBABAABAABCABACACCCCCCBAACBCCBCBABBCABABBABAAAACCCACCAACBBBCABCAACCBBBCACCCCABBABBBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBCCBCCCCBABBABCBACBBCAACBAAABABCBABBCBCBACCACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe" start= auto displayName= "UserDataSvc_ACBBCCBCCCCBABBABCBACBBCAACBAAABABCBABBCBCBACCACCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBCCBCCCCBABBABCBACBBCAACBAAABABCBABBCBCBACCACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe" start= auto displayName= "UserDataSvc_ACBBCCBCCCCBABBABCBACBBCAACBAAABABCBABBCBCBACCACCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBCCBCCCCBABBABCBACBBCAACBAAABABCBABBCBCBACCACCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBBCCBCCCCBABBABCBACBBCAACBAAABABCBABBCBCBACCACCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4820

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4160

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1860

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAACAACAACABACBCAAABBBCAACABAABBBAACACBBBAACBCCCBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAACAACAACABACBCAAABBBCAACABAABBBAACACBBBAACBCCCBCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACABBAAACBBCABABACBBBCCBCACABBBABAACBACCACCCBBABCBB.exe
1⤵
- Executes dropped EXE
PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 029e5799698f2e05c2ce34d7613e3eec01120c897a80588d5bd063575bb81829
MD5 82671c7d12834422f63264c77affe4d1
SHA1 6b0b83e174e5dbaf253d560b5a7c8068182944a2
SHA512 cf52a4c56ac54222c1131457b16558caa9b6d9d52b9aae02973f30e3ccd4b02273b00cbcad743aa2cd91612411c6af586ce280f5e0183225f11cd219d73069ab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b9e5d0cd69d9fc080453056ff0cf877c02253cc210ecf56cc4268c188911cefb
MD5 c873b28e331baf1e24798a5cb2bff475
SHA1 d8916ad4e42a216e770510cd51b575c6902f7884
SHA512 29114b21cf46aa55b2dd365dbfee9323637b16ca4fa0438e12850ef0ebf486667d0c7d8dfa028e88fcda44d4f8b1b14bffa1b6834cb20eeb0601bbc4637ed9cd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ef276df436ad966eb2d400faf03ec89eed5fa3425d6cf6c5d687cd6ae78203de
MD5 f5cc1ec059bf28818137eb17b9627fe1
SHA1 0e911de805245ae1f0171d4f6a3e9cfcd4d4edc3
SHA512 5328d65a44ec0acd91789bc5ec50399259b1353c2029f10f63c03c0067175979f9849f4a11449a359a32012b05492137f9d274d375eedde4ece5ea8e82121f96
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7968f28f8594546bf6bd0dc84e66bf5facd05f09d262d1b35a81d2b8cf857bd2
MD5 a7a7b76b1dfb9e9e32636a72473bdcf7
SHA1 c6adaa189410adc22a0de03320b5db4070c2c11b
SHA512 a124aeb1c348993b96a48a671bde0de13a4cab5de84866915f2e078ce3db537cc7c58a65c2fa1dabf7c38db0d7da7040eb0a5239238fa5cfb64eab3eba2c2c92
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ce18136c0aa2e5d9e1bf4588f17b5c05e5d8f48c35475299815d70aaec28c85c
MD5 94ea67b2be65b09b892147dcc50c5b86
SHA1 085396896d6bf9c83308836b99a1c84fd6985a5a
SHA512 66b969d057f46c7a9b3160eeeb302b73d3ae3d15e51952fe950a0ecef7ebf54e001f2091939383dcbfeca4e09d8c504d315516b542f32b1f3a8d770362a97823
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 30061291215420553fc257f0f723aa50b0c0ef37541c0932a8ebc07af94f3660
MD5 9a082424ac8726826f17395a4232cc1e
SHA1 171a9d2e0f7c46c64f9f405f4fb0a4f7e3bc5d69
SHA512 548046a590b3df7cc77b3adab20fe3136cd24d250faef9edc4210235dd63f1e04dfc9255b73687de1a12366a7e98461a23cdfd60f4c5cea5104dc51b31bfe7f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dd41c2840cef30302c6cdbc510a44612c3506842c3158a5796948ba14fc50ded
MD5 2ef85b0064eb57a852f83b0ddc204e9a
SHA1 90332ab92c8e8b5a8bf204c8c691230c556186da
SHA512 a750fa3ec804258a6b3f29d6dff72f0426fb4bacef4945c9e12f97a72a95198950d66f01eac96c8bf885f1713087931489cc0806a163e5c1d799f2ec487fa4e0
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 a103df5f5600f0f3a1f706fd643e2668b56f18d00e29d825e3d775da8f80ea1c
MD5 4790b754b780f0862ec259c439c6b2a9
SHA1 79b4d2602d0f7cc419f53358f63210b267618fc6
SHA512 882fec17bd3e2f4a3de348d874db7571c6b5861bdcfb70232879855b05f46eef41f2a1a346ab950d8ed69c58eea71868fb89459c64867ffefa036d4cfd81b5e1
TLSH
T18A1182AAE1E9DCC3F121648756355F5708B17BCBEC98EF2523044298B7A9C35CF190A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1080-0-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download

memory/1080-7-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download

memory/3296-72-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/3296-90-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/3576-36-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/3608-92-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/3952-59-0x0000000005350000-0x0000000005351000-memory.dmp

Download