29b2eae5a12b42e78a501c816fee6916bf755316368c7bebf9ef705b1e394954

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 21:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_39252980625393d7b66106f3b1c21116_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
Size 60.4MB
Sample260909-1jdl6ss1ex
SHA256 29b2eae5a12b42e78a501c816fee6916bf755316368c7bebf9ef705b1e394954
MD5 39252980625393d7b66106f3b1c21116
SHA1 7df35cc200869caa7b674a216a06fef72d4659e7
SHA512 5da714d4095e0c8e5d513d75880b841529a0233200126812b4294de4916150d8005fcb4fbf76518290c64acdbd45e89451da01826caf47c3dd419909a37642a8
SSDEEP 786432:f5evQHrK5/f4uUT5evQHrK5/f4uUT5evQHrK5/f4uUT5evQHrK5/f4uUYEIvu:kvQHW26vQHW26vQHW26vQHW2Cu
TLSH
T1FED79E17B35A81E6C02AE2B88A474212E7BA7C440334B7DF1695B7692F37BE4573B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4092	svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe
2876	svchost_CCAAAABCBBAABCACBACCBCCAABCABCABBCCBCACBBCABCCACABABABC.exe
1516	svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBAAABABABBBBCAACCBBCCCCCCCBBCBBAABAABBBBCBAACBABBCBCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe"	2026-09-09_39252980625393d7b66106f3b1c21116_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AAAACCBBCCBABBBAABBBCCABBACBBCBCCACABACBCAACBCACCBABBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAAAABCBBAABCACBACCBCCAABCABCABBCCBCACBBCABCCACABABABC.exe"	svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4352	sc.exe
4292	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
888	cmd.exe
2104	cmd.exe
3096	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_39252980625393d7b66106f3b1c21116_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAAAABCBBAABCACBACCBCCAABCABCABBCCBCACBBCABCCACABABABC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3060	2026-09-09_39252980625393d7b66106f3b1c21116_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
3060	2026-09-09_39252980625393d7b66106f3b1c21116_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
3060	2026-09-09_39252980625393d7b66106f3b1c21116_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
3060	2026-09-09_39252980625393d7b66106f3b1c21116_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
4092	svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe
4092	svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe
4092	svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe
4092	svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe
2876	svchost_CCAAAABCBBAABCACBACCBCCAABCABCABBCCBCACBBCABCCACABABABC.exe
2876	svchost_CCAAAABCBBAABCACBACCBCCAABCABCABBCCBCACBBCABCCACABABABC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3060	2026-09-09_39252980625393d7b66106f3b1c21116_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
Token: SeDebugPrivilege	4092	svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe
Token: SeDebugPrivilege	2876	svchost_CCAAAABCBBAABCACBACCBCCAABCABCABBCCBCACBBCABCCACABABABC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3744	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 888	3060	2026-09-09_39252980625393d7b66106f3b1c21116_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe	99
PID 888 wrote to memory of 3776	888	cmd.exe	101
PID 4092 wrote to memory of 5040	4092	svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe	102
PID 5040 wrote to memory of 4812	5040	notepad.exe	103
PID 3060 wrote to memory of 2104	3060	2026-09-09_39252980625393d7b66106f3b1c21116_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe	107
PID 2104 wrote to memory of 4352	2104	cmd.exe	109
PID 3060 wrote to memory of 3096	3060	2026-09-09_39252980625393d7b66106f3b1c21116_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe	110
PID 3096 wrote to memory of 4292	3096	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-09-09_39252980625393d7b66106f3b1c21116_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_39252980625393d7b66106f3b1c21116_amadey_cobalt-strike_elex_glassworm_hellokitty_hijackloa.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCCACAACAABBAAAABBACCAACCABAABCBCBCCCCBBABABBCCBBACCCACBCABABBACBBABCAABABCCBAAACACBACBCAABCBBBABCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCCACAACAABBAAAABBACCAACCABAABCBCBCCCCBBABABBCCBBACCCACBCABABBACBBABCAABABCCBAAACACBACBCAABCBBBABCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCABCBBACBBBAACBCAAACBCBCAAAACBABAAAAACBAAACBACBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe" start= auto displayName= "UserDataSvc_ABCABCBBACBBBAACBCAAACBCBCAAAACBABAAAAACBAAACBACBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCABCBBACBBBAACBCAAACBCBCAAAACBABAAAAACBAAACBACBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe" start= auto displayName= "UserDataSvc_ABCABCBBACBBBAACBCAAACBCBCAAAACBABAAAAACBAAACBACBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCABCBBACBBBAACBCAAACBCBCAAAACBABAAAAACBAAACBACBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCABCBBACBBBAACBCAAACBCBCAAAACBABAAAAACBAAACBACBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4292

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4812

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABCBBAABCACBACCBCCAABCABCABBCCBCACBBCABCCACABABABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABCBBAABCACBACCBCCAABCABCABBCCBCACBBCABCCACABABABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBAABCCCAABACCABBABCABBAABACBACCCBBBACACBCAABACBAABA.exe
1⤵
- Executes dropped EXE
PID:1516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 23a8843c7fd0e81c35a770092aabdb464250486ec4f3239c63a87a6e1da3af41
MD5 6e2b7c3969b03ca91a1ae486ad98d766
SHA1 e600d57d049bfba1c0e83fc437de69e4c566359b
SHA512 26ba44215ba2f06bfb5016bf305169c1fc434549b896ce8577ab26ef60e8b30e3a16b44bff4f829aaf1a9a90f3bf823780bb68fe57d0954c0d1af2b0d5b4a005
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7bd6259022066f28ed568c857e812668ef4a33912448473e78bf739852fcdf4b
MD5 52501aebaa17c175f050f1c2298b868a
SHA1 e0bb861c6ff7a8443c920e624a5a440a84d3f59d
SHA512 574c358d3a1face4754763cf7b67159c18846354ea1336656031d46e86efb8796cfc985ad9a14c870adbd40ac3cfbd29f5b9dfb46b0e24d2defe2e3d7baa6fac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e266f4caa3a3aba6617c515001efe88b6456a838ab0e67694182e127699e3ae8
MD5 189b599132b8ffda8a6f3a9e8bcb1934
SHA1 ba218556a477d3a933d227c5fa1495b542505895
SHA512 9530233acf286df6641f1580b34f210060a3dedc18c5a789703aaba83d6eb4aa64677306e18417d58e29f410691dc8e5e0c221eae4728c681cf516ddacd1929c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a316e4d4bc85c6c62d295f0a5fff5197f502eb2b0113ad62efbca053e63c4f50
MD5 0d8548aa443fb412b3b9bbb3589b15fb
SHA1 c822e70fd932838833523da1d2559a8d3decab37
SHA512 f555baae251cd2bd5e9c8b0c71ed420955d0f476c0d8bcce28afd2ff7da227cb93f80afe9a8e779d2d97d60038362ab49df1b5cdd26e30f203eeff384dfeb2f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6f6d48fabe0d95b5a7ce6cefa1f7b9d58b2c853f085363c46061816585f15cd5
MD5 7e32ad624ad1ddb65b54341bc7f3cd42
SHA1 779d21a9e97c6762d50cd20c19254f6836fbbda5
SHA512 a4cf0ec06022992fec598528f7c16ac2d7207baaf7f79f46e899ca5046bb04d47bc3ae51b2b28d319fbf1ccb670c9f2b794de1138f16c414ad3838210a1d2f2b
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 9cbf3f5d656df9b8d7ce3ad9b70a48c2d2071daf615866b0e13409ecc3e9e1de
MD5 671d876cbc6e46cf73284450e9063aef
SHA1 aae6fa7f021b8da5f16d57c85de9f10cbb1e5c2f
SHA512 b03589e1c86aeac01872340a3d449126c1fb40d1c542ba40b65828a224342daf83e14e9f3fa570d132e096665ed5f894381c71b02dabe4eceb4be7e5768a86d2
TLSH
T119119451E0A6DC13E125A88B7219EA8B4CA43BD7EC5CAB94230A421DAF9DC39CD154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2876-87-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/3060-0-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/3060-8-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/4092-27-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download

memory/4092-37-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download

memory/5040-59-0x00000000050D0000-0x00000000050D1000-memory.dmp

Download