543f3ee125edf0c13058aabd4696e42e8bfd266cba8b6585d9fc37c408eb489f

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_1861dc712cfa7304932dbb22ab22a0ec_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_.exe
Size 64.0MB
Sample260909-3rk3bstyft
SHA256 543f3ee125edf0c13058aabd4696e42e8bfd266cba8b6585d9fc37c408eb489f
MD5 1861dc712cfa7304932dbb22ab22a0ec
SHA1 2b7051f39aa0fd3c47445b4065a649a07768a13f
SHA512 c5d4de8908ffe88fd8da0b194a257ca35bc76d1358d94a0b8841fa568b5a99f0bcc87defde61fb09673576ed7ca175eeff1825aef8647112d020060e353e2358
SSDEEP 786432:FvQHrK5/f4uU5vQHrK5/f4uU5vQHrK5/f4uU5vQHrK5/f4uUYEIvV:FvQHW2PvQHW2PvQHW2PvQHW2CV
TLSH
T163E7AE17B35681E6C02AE2B88A474327D7B9BC440330A7DB16D5B76A2F37BE4573A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2632	svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe
3408	svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe
1968	svchost_BBBAABAAABBCACCCBBCBABBCCACCCBCBCAAACAACCBCBACAABCAABAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBAAABCABCCAACABBCACBBBBBBBACCBBCACBBACCCACACCBBACCCACAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe"	2026-09-09_1861dc712cfa7304932dbb22ab22a0ec_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AAAACBBAABCCCCCCBACCBBBAABBBBAAACCAACCCCAAAAABCBCCAAACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBAABAAABBCACCCBBCBABBCCACCCBCBCAAACAACCBCBACAABCAABAA.exe"	svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5080	sc.exe
2552	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1404	cmd.exe
2716	cmd.exe
1704	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_1861dc712cfa7304932dbb22ab22a0ec_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBAABAAABBCACCCBBCBABBCCACCCBCBCAAACAACCBCBACAABCAABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3360	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1112	2026-09-09_1861dc712cfa7304932dbb22ab22a0ec_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_.exe
1112	2026-09-09_1861dc712cfa7304932dbb22ab22a0ec_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_.exe
1112	2026-09-09_1861dc712cfa7304932dbb22ab22a0ec_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_.exe
1112	2026-09-09_1861dc712cfa7304932dbb22ab22a0ec_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_.exe
2632	svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe
2632	svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe
2632	svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe
2632	svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1112	2026-09-09_1861dc712cfa7304932dbb22ab22a0ec_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_.exe
Token: SeDebugPrivilege	2632	svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2988	OpenWith.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1704	1112	2026-09-09_1861dc712cfa7304932dbb22ab22a0ec_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_.exe	99
PID 1704 wrote to memory of 3360	1704	cmd.exe	101
PID 1112 wrote to memory of 1404	1112	2026-09-09_1861dc712cfa7304932dbb22ab22a0ec_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_.exe	102
PID 1404 wrote to memory of 5080	1404	cmd.exe	104
PID 1112 wrote to memory of 2716	1112	2026-09-09_1861dc712cfa7304932dbb22ab22a0ec_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_.exe	105
PID 2632 wrote to memory of 4312	2632	svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe	109
PID 4312 wrote to memory of 2828	4312	notepad.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-09_1861dc712cfa7304932dbb22ab22a0ec_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_1861dc712cfa7304932dbb22ab22a0ec_amadey_cobalt-strike_darkgate_elex_glassworm_hellokitty_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBBAABBBBABBBBCCABBBCCCCBCAABCCBCBCCBCCBCCBBACBBAABAAABBBBCAABCACACBCBBCBCCBACACBCAAACCCACBBCBBAACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBBAABBBBABBBBCCABBBCCCCBCAABCCBCBCCBCCBCCBBACBBAABAAABBBBCAABCACACBCBBCBCCBACACBCAAACCCACBBCBBAACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCABACCAABAAACBBBBABCCABCAABBBBAAACCAACBCBBACCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe" start= auto displayName= "UserDataSvc_ACCABACCAABAAACBBBBABCCABCAABBBBAAACCAACBCBBACCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCABACCAABAAACBBBBABCCABCAABBBBAAACCAACBCBBACCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe" start= auto displayName= "UserDataSvc_ACCABACCAABAAACBBBBABCCABCAABBBBAAACCAACBCBBACCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCABACCAABAAACBBBBABCCABCAABBBBAAACCAACBCBBACCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2716
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCABACCAABAAACBBBBABCCABCAABBBBAAACCAACBCBBACCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCACCACCBACACCBBBBABBCBAAAABACAAABABCCCAAAAAAABBACA.exe
1⤵
- Executes dropped EXE
PID:3408

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2988

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAABAAABBCACCCBBCBABBCCACCCBCBCAAACAACCBCBACAABCAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAABAAABBCACCCBBCBABBCCACCCBCBCAAACAACCBCBACAABCAABAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5532fa9202903ff0b6360ad69eadf97828e6c75563ab6c14c3423c26f64aaea4
MD5 c83b7f0fa0d08c717863d399c3f86cb1
SHA1 3fbbe8024f9a48dd9b10851067dd78fa09eebb04
SHA512 27397001d1b47f847ce9689fd6372712982bff369ff034e545c5c80ad0453fb238a5722593784ccdfe2de30c6e2e97b76d86de4fdbc55bd51b49c2a7cf7f953d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1fc77d8b4285e169106fe5b2226b208366c0e929efb61f885982053a0835e764
MD5 550f284f7ff815d1f0f478fd057608f7
SHA1 3bb51870a85bbc910d96d3843c1e73ac7f6937a2
SHA512 bb49db96c2a09fc7035ea8cb27542b59ccba3a493ccea55ab1675741d57d2ed010a6ed1702fc2eaadab163c41773d74287108e0efad978ae4bc6e5ffed7f1e5f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0409353a92f512db00dd8a14e098dcb20e3d21d4c2e7d4af9a342916c6d831af
MD5 05be2422871d2b8c4140930a25a2f750
SHA1 ac6c95dd9985f8c7f809137fed0463df404bd733
SHA512 821d9e8b37265671cbde3982d140de90a1b5f4fe458fe1f09d7594b7b2aeb0aa3d8bb335a351411f8c67914980738084ef125382acfffefaf4b4463c66921434
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3173daec848390e988c5557a23bbc5ef7577b956cae6407d96f5a12b58d98533
MD5 3d240ade0416d8b2b2a364673f3b22e9
SHA1 3516a9dd15e00b31d8ab55fad0787a943fc71551
SHA512 597fab183d7806b656ad3790511478c1678181d2065635ccf105ad0304d4d30ac1f19e9497c6157a5fc14940ae6a72eba9c1c2d4f4470d2b0965aa7a67207413
MD5 SHA1 SHA512

Submit Download

memory/1112-63-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/1112-37-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/1112-0-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/1112-24-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/1112-11-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/1112-94-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/1968-97-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/2632-54-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/2632-31-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/2632-77-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/3408-96-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/4312-87-0x0000000005370000-0x0000000005371000-memory.dmp

Download