6fcc38cf3a5d431f146b3ca9d439b7d5765bab9845016fa4ab16ad1be4d4b632

Analysis

max time kernel
151s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_808abc60c647f2d3428c687ea1c05d19_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Size 50.9MB
Sample260907-sqd8aahf69
SHA256 6fcc38cf3a5d431f146b3ca9d439b7d5765bab9845016fa4ab16ad1be4d4b632
MD5 808abc60c647f2d3428c687ea1c05d19
SHA1 918a6f125524d879c097d648644063fc9dc6c547
SHA512 98fc1051190f5c0d0f40d9668465e00255b3e0e1768ac0432cc9aa8f128bb8208e74c244d0119211cef03b6f97bca77c8c164fc7e05136d3bf29379fa5cbbf9d
SSDEEP 786432:AvQHrK5/f4uU8vQHrK5/f4uU8vQHrK5/f4uUi:AvQHW2qvQHW2qvQHW2I
TLSH
T14CC7AE17F24681E6C02AD2B88A478327D7B57C440331A7DB66D9B76A2F33BE4573A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
824	svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe
1692	svchost_BBCCAACBBCBCBCBBAAACBBABABBBCCBCCBBABABCCBAACCBBBBCCACA.exe
3472	svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBCCABAABACCBBCCCACCBAAAAABABBBCCCAACACCCCABCCAAABBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe"	2026-09-05_808abc60c647f2d3428c687ea1c05d19_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBCCCCAABBBBCACBBAAACCCABABCBAACAABAAACCCCACBCCBCBCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCAACBBCBCBCBBAAACBBABABBBCCBCCBBABABCCBAACCBBBBCCACA.exe"	svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3908	sc.exe
3412	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1108	cmd.exe
3396	cmd.exe
5576	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_808abc60c647f2d3428c687ea1c05d19_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCAACBBCBCBCBBAAACBBABABBBCCBCCBBABABCCBAACCBBBBCCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1228	2026-09-05_808abc60c647f2d3428c687ea1c05d19_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
1228	2026-09-05_808abc60c647f2d3428c687ea1c05d19_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
1228	2026-09-05_808abc60c647f2d3428c687ea1c05d19_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
1228	2026-09-05_808abc60c647f2d3428c687ea1c05d19_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
824	svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe
824	svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe
824	svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe
824	svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe
1692	svchost_BBCCAACBBCBCBCBBAAACBBABABBBCCBCCBBABABCCBAACCBBBBCCACA.exe
1692	svchost_BBCCAACBBCBCBCBBAAACBBABABBBCCBCCBBABABCCBAACCBBBBCCACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1228	2026-09-05_808abc60c647f2d3428c687ea1c05d19_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Token: SeDebugPrivilege	824	svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe
Token: SeDebugPrivilege	1692	svchost_BBCCAACBBCBCBCBBAAACBBABABBBCCBCCBBABABCCBAACCBBBBCCACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1108	1228	2026-09-05_808abc60c647f2d3428c687ea1c05d19_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	92
PID 1108 wrote to memory of 5012	1108	cmd.exe	94
PID 824 wrote to memory of 6032	824	svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe	95
PID 1228 wrote to memory of 3396	1228	2026-09-05_808abc60c647f2d3428c687ea1c05d19_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	98
PID 3396 wrote to memory of 3908	3396	cmd.exe	100
PID 1228 wrote to memory of 5576	1228	2026-09-05_808abc60c647f2d3428c687ea1c05d19_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	101
PID 5576 wrote to memory of 3412	5576	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-05_808abc60c647f2d3428c687ea1c05d19_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_808abc60c647f2d3428c687ea1c05d19_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBACBCBBCAABCACCCCACBABACCABCAABAABACBBABAAACBBBCAACABBCBCABBACAAACBAACAABACCACCBBABBCAABBBBBABABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBACBCBBCAABCACCCCACBABACCABCAABAABACBBABAAACBBBCAACABBCBCABBACAAACBAACAABACCACCBBABBCAABBBBBABABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACABBBABCCACAABAABBACBBCABBCACBCBCBCCCABAABBCBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe" start= auto displayName= "UserDataSvc_ABACABBBABCCACAABAABBACBBCABBCACBCBCBCCCABAABBCBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACABBBABCCACAABAABBACBBCABBCACBCBCBCCCABAABBCBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe" start= auto displayName= "UserDataSvc_ABACABBBABCCACAABAABBACBBCABBCACBCBCBCCCABAABBCBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACABBBABCCACAABAABBACBBCABBCACBCBCBCCCABAABBCBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5576
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACABBBABCCACAABAABBACBBCABBCACBCBCBCCCABAABBCBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAACBBCBCBCBBAAACBBABABBBCCBCCBBABABCCBAACCBBBBCCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAACBBCBCBCBBAAACBBABABBBCCBCCBBABABCCBAACCBBBBCCACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCBCACACABABCCACCBABCAAACBABBACBCBBBABBCBAABBAABBBB.exe
1⤵
- Executes dropped EXE
PID:3472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b685dd16d6216c895cb3b13ccfdd774e5bd97d3617916aa1924f5bc3814df9af
MD5 725e81f36edf65f199324be805a4db51
SHA1 7fc574c5ba94e35ad8ab2da6860a8d218af0988d
SHA512 7dcf364d9b3985ab4f16d62287e07318ce41b137eaaacadcda5ec83ea92e6475760c2323e1ebb077f2e51880a3376784a62af34c53a4310ba82e096ba3aaabad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 417b25ce8dfe91db7c631ea70ef4a09667d6d18792f789c1adc61371ee31779a
MD5 115d74ddbf72d6a197218dccb9a4b096
SHA1 a4b0f7fff8002726c312220a0e0b1c35efd889a4
SHA512 d040687a41de2c38232cfc056a55bf9b5dcadeb4749c0b80be52370cdd8f45454c97c6cf345fcb1f97c7e0a5a68c408ef7f4a7d7ef3ae66594b7d04e32117f28
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 787e1ee484425d274cf836e1179f114bd826eb1d8f90cfc3a6d510ef37877674
MD5 1df7b5d07e7111c900cc9f28a53bf2c8
SHA1 53ca2640829ceab4119e473fcd210461908c2543
SHA512 778141d4baf3e099e0137cce3fe380e07dba12bfc8159eb6bb3390f0e53bc8374ada70f641aa5554067e3c49a5c8c97b84a0781a0791c93362832f68bcd9cab6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 475988a04cb2278e9632ae941ad4b657ff94c662061958787ccc0f6d5b3e1be7
MD5 7d49b0a0b99c97cb1360dca7513ac094
SHA1 fd1dfb98dc6e32f93ec124c8098c0a3d73bce90e
SHA512 c05c016848bad6a01bad5da82c8178a1275020acb7d9f707e44e490a6f345aa7fa83b2145c1b9e1d7250e5d762c8bb5aa84669ca7dc3c6d9b5cdede4c061f61d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 57c6d0cf9441b7e23b43167363ef33f5c5fc9dbd04f8b4daf167390dfc32afff
MD5 9e234b61db50f838ec27f5b2e8453dbf
SHA1 9bd748de2779f3a7e42dcdb31450b22f8bc8482b
SHA512 7f129733ca76a218dfefa474aa3c135834249c4869827b1dea6f843bb9714f36f46a7b7be7e4581a888d21a55e347e13307d27306902aee38e9d96eff458299d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3c265857fe4333bcedaf41fb167a68f941730fc0a1a5a48cb10c15c7af4bdb07
MD5 8ff226bea9b44e7af1c72b20a0eed338
SHA1 936742382a3e99a6fec9966e60d21ba38fc521bf
SHA512 938ca46664046149c5614b416918d51487c23c984478a778d2129e5a87afe9b7ea88937eff2fa7d8c9ade45042284475be063f237a745cb65cd4ee4bc9a26548
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5e2c1efeab168ff405e887c030f4a769e50995d844052c1088053eb7f88384d9
MD5 88564bf17e2cce21bae47c63cae58c9c
SHA1 9227aab94ded65f68833eba5ba1e033a4048f3f1
SHA512 ae442f6146a8d0729b0010f565940f2df03726d0c36161f095fbc1afd8fa096dac33ea19d31a79ea193ae602ca9e27e350b4bfc4fb017e8873d87ddfd5bf2189
TLSH
T13711EB85F0669CABF1306CC7861DCAC70C983B4F695CAFA8730A911CB74EC359D5A4E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/824-48-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/824-69-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/824-87-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/1228-23-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/1228-49-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/1228-12-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/1228-0-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/1228-71-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/1692-81-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download