Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 01:29
General
- Target 2026-09-08_f90917d7fe62c1cac9a83ebb0d071556_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_.exe
- Size 7.9MB
- Sample260910-bwanlsee63
- SHA256 86b91ab3e868bc4fad38270e64d521347b581e039bf528565fe6d61f52a0545c
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
- Detects executables manipulated with Fody 1 IoCs
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_f90917d7fe62c1cac9a83ebb0d071556_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_f90917d7fe62c1cac9a83ebb0d071556_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_f90917d7fe62c1cac9a83ebb0d071556_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_f90917d7fe62c1cac9a83ebb0d071556_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_.exe" -restart2⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vcredist.tmp"C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{ACB02ED9-EA35-48C7-BC32-B255CC56621E}\.cr\vcredist.tmp"C:\Windows\Temp\{ACB02ED9-EA35-48C7-BC32-B255CC56621E}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=752 -burn.filehandle.self=756 /q /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{5F3FCECC-A0EC-4853-91D9-C41AF85D55D0}\.be\VC_redist.x86.exe"C:\Windows\Temp\{5F3FCECC-A0EC-4853-91D9-C41AF85D55D0}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{5303D428-A21A-4D53-9DBB-263DD0ED0C7B} {C6B54DDE-03A5-4ECD-94B1-F4D7BE9A96A0} 26445⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-09-08_f90917d7fe62c1cac9a83ebb0d071556_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_.exe.config
RAMTheme.ini
log4.config
vcredist.tmp
logo.png
wixstdba.dll
vcredist.tmp
memory/1144-31-0x000000000CC50000-0x000000000CD02000-memory.dmp
memory/1144-34-0x000000000D080000-0x000000000D09A000-memory.dmp
memory/1144-282-0x000000000E6A0000-0x000000000E9FB000-memory.dmp
memory/1144-13-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/1144-14-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/1144-281-0x00000000084E0000-0x00000000084EA000-memory.dmp
memory/1144-17-0x0000000006D40000-0x0000000006DB4000-memory.dmp
memory/1144-18-0x0000000006F00000-0x0000000006F0A000-memory.dmp
memory/1144-280-0x00000000083B0000-0x00000000083B8000-memory.dmp
memory/1144-20-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/1144-21-0x000000000BFD0000-0x000000000C004000-memory.dmp
memory/1144-22-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/1144-23-0x000000000C610000-0x000000000C6A2000-memory.dmp
memory/1144-24-0x000000000C6A0000-0x000000000C6AA000-memory.dmp
memory/1144-29-0x000000000CBB0000-0x000000000CC08000-memory.dmp
memory/1144-279-0x0000000008380000-0x0000000008396000-memory.dmp
memory/1144-32-0x000000000CE50000-0x000000000CE72000-memory.dmp
memory/1144-33-0x000000000CFC0000-0x000000000D07E000-memory.dmp
memory/1144-35-0x000000000D0C0000-0x000000000D0C8000-memory.dmp
memory/1144-278-0x00000000063C0000-0x00000000063CA000-memory.dmp
memory/1144-36-0x000000000D0B0000-0x000000000D0B8000-memory.dmp
memory/1144-37-0x000000000D100000-0x000000000D10A000-memory.dmp
memory/1144-277-0x000000000FF20000-0x000000001044C000-memory.dmp
memory/1144-137-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/1144-114-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/1144-103-0x00000000084F0000-0x0000000008502000-memory.dmp
memory/1144-100-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/1144-101-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/4984-1-0x0000000000190000-0x0000000000972000-memory.dmp
memory/4984-2-0x0000000005A20000-0x0000000005FDA000-memory.dmp
memory/4984-3-0x0000000005340000-0x0000000005386000-memory.dmp
memory/4984-4-0x0000000074BC0000-0x000000007537C000-memory.dmp
memory/4984-7-0x00000000053F0000-0x000000000540E000-memory.dmp
memory/4984-0-0x0000000074BD2000-0x0000000074BD3000-memory.dmp
memory/4984-6-0x00000000053B0000-0x00000000053D6000-memory.dmp
memory/4984-5-0x0000000005460000-0x00000000054F2000-memory.dmp
memory/4984-12-0x0000000074BC0000-0x000000007537C000-memory.dmp