40d628a1009d1e1074488ffa88c4bb02997094cdb7a66182e5238dd0c2dec08c

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_c829da69ca480894be7ca5d5c00a539f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_ice.exe
Size 22.2MB
Sample260908-pfsfdazdja
SHA256 40d628a1009d1e1074488ffa88c4bb02997094cdb7a66182e5238dd0c2dec08c
MD5 c829da69ca480894be7ca5d5c00a539f
SHA1 87c20a3d4988dbd6fad2d0d60110e415ddf2d09a
SHA512 8f3b8c877a0870754c9afdf267999ef3ab89cbf5fa0414a4db6ae6376487369344bb7ba7dd6a72d67d3407095d922fe9169121eb09fc59cbe11bf28cf2132da5
SSDEEP 393216:+5O5y5O5y5O565y5O5y5O5y5O5zmHN6+Jrvt:+5O5y5O5y5O565y5O5y5O5y5O5ybr1
TLSH
T15E376D5877EA60E5E5B782708866C3B6DA317C214B3183DF6658F32D1E336D09D39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5704	svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe
3832	svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe
2100	svchost_ABAACCCCABBAACAACABBBACCABCABCBBABBACBCCBACBCBAAACBCACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAABBCCAABACAABABCCBBABAABAABBBCCBBBBCBAABAABBCBBCACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe"	2026-09-08_c829da69ca480894be7ca5d5c00a539f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_ice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAACABACCAABCABCBBAACCCCABCAABAAAACBACABCAAABCCBAABBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAACCCCABBAACAACABBBACCABCABCBBABBACBCCBACBCBAAACBCACA.exe"	svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4512	sc.exe
6080	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4848	cmd.exe
4136	cmd.exe
6088	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_c829da69ca480894be7ca5d5c00a539f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_ice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAACCCCABBAACAACABBBACCABCABCBBABBACBCCBACBCBAAACBCACA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5012	2026-09-08_c829da69ca480894be7ca5d5c00a539f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_ice.exe
5012	2026-09-08_c829da69ca480894be7ca5d5c00a539f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_ice.exe
5012	2026-09-08_c829da69ca480894be7ca5d5c00a539f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_ice.exe
5012	2026-09-08_c829da69ca480894be7ca5d5c00a539f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_ice.exe
5704	svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe
5704	svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe
5704	svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe
5704	svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5012	2026-09-08_c829da69ca480894be7ca5d5c00a539f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_ice.exe
Token: SeDebugPrivilege	5704	svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 4136	5012	2026-09-08_c829da69ca480894be7ca5d5c00a539f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_ice.exe	93
PID 4136 wrote to memory of 3144	4136	cmd.exe	95
PID 5012 wrote to memory of 6088	5012	2026-09-08_c829da69ca480894be7ca5d5c00a539f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_ice.exe	96
PID 6088 wrote to memory of 4512	6088	cmd.exe	98
PID 5012 wrote to memory of 4848	5012	2026-09-08_c829da69ca480894be7ca5d5c00a539f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_ice.exe	99
PID 4848 wrote to memory of 6080	4848	cmd.exe	101
PID 5704 wrote to memory of 3756	5704	svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-08_c829da69ca480894be7ca5d5c00a539f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_ice.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_c829da69ca480894be7ca5d5c00a539f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_ice.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBBACABACACABCCACAAACCABBCAABABCBABBCCCCABCABBCAAACAAACCCAABACBCBAAACABCCCCCBBBBBCACCCAAAAACBCBCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBBACABACACABCCACAAACCABBCAABABCBABBCCCCABCABBCAAACAAACCCAABACBCBAAACABCCCCCBBBBBCACCCAAAAACBCBCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCCAACBCCABCAACABAABCBCCABCCCBCBAABCBACBBBAAACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe" start= auto displayName= "UserDataSvc_ACBCCAACBCCABCAACABAABCBCCABCCCBCBAABCBACBBBAAACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCCAACBCCABCAACABAABCBCCABCCCBCBAABCBACBBBAAACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe" start= auto displayName= "UserDataSvc_ACBCCAACBCCABCAACABAABCBCCABCCCBCBAABCBACBBBAAACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCCAACBCCABCAACABAABCBCCABCCCBCBAABCBACBBBAAACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCCAACBCCABCAACABAABCBCCABCCCBCBAABCBACBBBAAACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6080

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5704
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3756

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe
1⤵
- Executes dropped EXE
PID:3832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCCABBAACAACABBBACCABCABCBBABBACBCCBACBCBAAACBCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCCABBAACAACABBBACCABCABCBBABBACBCCBACBCBAAACBCACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 22f6576877c458e38ebead1d285403ad9c0367b3dfb19d8523ad6e663081f696
MD5 31a5d5e80b3fe011e2962a5c6b9fac84
SHA1 dda5cea4809adde0111215282ffd40e85c81c86b
SHA512 ef33ba4e34112ed6b02e45c242c4b414a057be8b42164288add2e1233708031b91f817c515d436501849420b258b088ed40660f91ee0fc1daa3997976f9d82fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 173b3ddfc5dcd157c851faabbe67610080580fd9c801de0ba3f9c8c7bace532e
MD5 2f1735f3ab4050b4b1bfb494367d8675
SHA1 c2b397b2b793389705731f3c93fa52d6b10152e6
SHA512 7b287ef0cb50b6af426dd15a93b47b6aab900925ec998ed71372f6536caf8ff3351e7863f7449af36bacf55540701871e0ace47fb173952d8e1abf658c50357f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9e6700ef7354caa02cfd5b5fdae10fdf3c3a4e707fbe09ca1925cfdfbece5ffe
MD5 ab2479d3caa0087461b815eba905944f
SHA1 ce25d14703aba20586991ae0a1ff25f2658854b6
SHA512 d0d532ebb689dd6e9d2ec355d698a3bdaafac9c020f3fc627b5cffd3e6b82d2873a09fde9ab47efab0d689cfe7846b151f08c4ba5c8837364f1aa8e472c5dca5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f9429a5f0ae37c228cece22054546e3a72103687459e88c96fffcc081897a84e
MD5 34de53913608d17c570581ea49ccacf9
SHA1 335d7323b718a18e40503227c1ee53b5540ad9b8
SHA512 7de5af9850bb88af5e25015f5c4b8ab13b82605d20d312398ae2b2f6e54b1b679b123888fc4f525553f08800a0a97a25f727190ab04da9adf91b498bf91e377f
MD5 SHA1 SHA512

Submit Download

svchost_ABAACCCCABBAACAACABBBACCABCABCBBABBACBCCBACBCBAAACBCACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCCABBAACAACABBBACCABCABCBBABBACBCCBACBCBAAACBCACA.exe
Size 12.4MB
SHA256 9162b208e740ae9a8933b985dd9561d96e0409e4c96697ca4ff0e0c95df84ff6
MD5 6a3e4107f31c9216432dd9bdca820be7
SHA1 f48d5619be22155fee787c72fe6499acda22bc3c
SHA512 821e5a4ea891f59ba90842210c077c60386ca8ac7c05641caa43622e3812f14c7db5f8338ced6a770ece9d645104f4622557a31f87cc8f8b08c85984859e552a
SSDEEP 98304:gR350l350R350l350R350l3501l350R350l350R350:+5O5y5O5y5O565y5O5y5
TLSH
T172D64B49BBEA5151E9B342708CAAC2F65D31BC204F2197EF6680F32D5E336D0E539B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABBACCBACCABBBABBCBAABACBAABCAABCCBCBAAACACCABACAB.exe
Size 22.2MB
SHA256 40d628a1009d1e1074488ffa88c4bb02997094cdb7a66182e5238dd0c2dec08c
MD5 c829da69ca480894be7ca5d5c00a539f
SHA1 87c20a3d4988dbd6fad2d0d60110e415ddf2d09a
SHA512 8f3b8c877a0870754c9afdf267999ef3ab89cbf5fa0414a4db6ae6376487369344bb7ba7dd6a72d67d3407095d922fe9169121eb09fc59cbe11bf28cf2132da5
SSDEEP 393216:+5O5y5O5y5O565y5O5y5O5y5O5zmHN6+Jrvt:+5O5y5O5y5O565y5O5y5O5y5O5ybr1
TLSH
T15E376D5877EA60E5E5B782708866C3B6DA317C214B3183DF6658F32D1E336D09D39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5012-0-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/5012-8-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/5704-24-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/5704-37-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download