2a016f743b423474db6b5c6ac91e506b8958d2cc659bd8be93720da209219413

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_0569dbd7d2e6813d9b6f4a804fbd04bb_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 16.1MB
Sample260910-jph1eazfkc
SHA256 2a016f743b423474db6b5c6ac91e506b8958d2cc659bd8be93720da209219413
MD5 0569dbd7d2e6813d9b6f4a804fbd04bb
SHA1 1715cd7fc753e2401db2d88069b4401d32d88e30
SHA512 a2d989f33c21f8e750ffa080c77cce9644cf703d8cdd5968051ba4a776a13309a3cc623ae1e226385b6f8de810b5d19ff4486cf10de93d74389f6727edd0ac22
SSDEEP 196608:b7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToug:bahvQHrc8u3xXJ/f4uUWHl
TLSH
T1B207AE17B34681E6C02AD2B88A478327D7B5BC440330A7DB66D5B76A2F37BE4573A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000245a8-21.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000245a8-21.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000245a8-21.dat	INDICATOR_EXE_Packed_Yano

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3196	svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe
1560	svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe
1048	svchost_ACCBCBCBABABABACBAABABCBCCCABCABBBCBBCBCAABABCCBBABBAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBCABBABBABBCCABAAABCAAABCCBCAABAABCACBAAACACAAACAACBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe"	2026-09-08_0569dbd7d2e6813d9b6f4a804fbd04bb_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBABCBAAABCCAACBABBACCBAAACCAACBCAACACBAABAAABACABABABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBCBCBABABABACBAABABCBCCCABCABBBCBBCBCAABABCCBBABBAAC.exe"	svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2280	sc.exe
1404	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2832	cmd.exe
1304	cmd.exe
3200	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBCBCBABABABACBAABABCBCCCABCABBBCBBCBCAABABCCBBABBAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_0569dbd7d2e6813d9b6f4a804fbd04bb_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1584	2026-09-08_0569dbd7d2e6813d9b6f4a804fbd04bb_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1584	2026-09-08_0569dbd7d2e6813d9b6f4a804fbd04bb_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1584	2026-09-08_0569dbd7d2e6813d9b6f4a804fbd04bb_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
1584	2026-09-08_0569dbd7d2e6813d9b6f4a804fbd04bb_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
3196	svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe
3196	svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe
3196	svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe
3196	svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1584	2026-09-08_0569dbd7d2e6813d9b6f4a804fbd04bb_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Token: SeDebugPrivilege	3196	svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1688	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2832	1584	2026-09-08_0569dbd7d2e6813d9b6f4a804fbd04bb_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	99
PID 2832 wrote to memory of 4864	2832	cmd.exe	101
PID 3196 wrote to memory of 3472	3196	svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe	102
PID 3472 wrote to memory of 3224	3472	notepad.exe	103
PID 1584 wrote to memory of 1304	1584	2026-09-08_0569dbd7d2e6813d9b6f4a804fbd04bb_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	105
PID 1304 wrote to memory of 2280	1304	cmd.exe	107
PID 1584 wrote to memory of 3200	1584	2026-09-08_0569dbd7d2e6813d9b6f4a804fbd04bb_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	108
PID 3200 wrote to memory of 1404	3200	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-08_0569dbd7d2e6813d9b6f4a804fbd04bb_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_0569dbd7d2e6813d9b6f4a804fbd04bb_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACABCBABBBBCBCBAABABABCABBBBBBAACCBBABBACABCCBAACACCCCBBBAACCBAACABAAAACCAACCAACBAAAAAACCBBCABBACAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACABCBABBBBCBCBAABABABCABBBBBBAACCBBABBACABCCBAACACCCCBBBAACCBAACABAAAACCAACCAACBAAAAAACCBBCABBACAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABACBBAACBBABCBBCCCCBACBABCBAAAACCACCCCAABBACBACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe" start= auto displayName= "UserDataSvc_CABACBBAACBBABCBBCCCCBACBABCBAAAACCACCCCAABBACBACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABACBBAACBBABCBBCCCCBACBABCBAAAACCACCCCAABBACBACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe" start= auto displayName= "UserDataSvc_CABACBBAACBBABCBBCCCCBACBABCBAAAACCACCCCAABBACBACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABACBBAACBBABCBBCCCCBACBABCBAAAACCACCCCAABBACBACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABACBBAACBBABCBBCCCCBACBABCBAAAACCACCCCAABBACBACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1404

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3224

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1688

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe
1⤵
- Executes dropped EXE
PID:1560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBCBABABABACBAABABCBCCCABCABBBCBBCBCAABABCCBBABBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBCBABABABACBAABABCBCCCABCABBBCBBCBCAABABCCBBABBAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3b489bfcdf2a5644c02d432f172d34b066a403713da406010e25456905338bb6
MD5 630ab1b2290ba03808b1010b31b7c390
SHA1 c9c6a1bcfea0a68f3696ae11fe898263ec2ee4ca
SHA512 59467059617bbd1af1d0db5dbff9b309017a2f9c3590c217367a5c31f1a9e9430df08bedaee78238f011819a29344ae2f3c12aeac93354723730bfc9ae3a488a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 495fb1105c9fe94c3c0729fc80472a3b2487f636572684a519e8346e55e84169
MD5 eb0d63c00b8209771e444cdb8c54e4f6
SHA1 e4d08585c13efa9cd259b020e9f66d1cb7fd130b
SHA512 d471f7de99706949ca6f1fb794d3f33d88439a1a9352e2492224d7b2937bc0cbd6c457d77e458b10ae151fb70a158550df7ba8574f8d9fe64db133c12f1cfa78
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 07eb8350d09c0eaeb6a38be4561285713662d3496b018cbd466d3ea257dc706a
MD5 1f85f1a219a4acc6c969bf2265edd9dc
SHA1 2fd6216697c7db8964993e440501d5f14a8a74c6
SHA512 6d6b55f2d63694c7257c5a15b81720bd91404712028ca405205474bb9a4167910192af22e83a2fb569dd15827958f96f46362bbaa2fa4084fda070e0501cb943
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 617b8dec429922943718ee5a48a4021346e3ff49378466c41a95997506d277ac
MD5 f37ff57335753cb24af630c5eda23881
SHA1 e61d649408fee28b9bdd0005d515407dc44d0cad
SHA512 ca87fe469c3e969b0fcdaa5d2e7f7dc33cc6046c4aac2fd823ee5a8c33a096c2c920ab618931111ae8bc95125f304d23a6ab30833c069a8ac5ba5fbf5d0cdf84
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 75bbab8ea398068499144c8c00685b22fe2191805f7424ab759bc4bc1ea8fcae
MD5 86cef0f32e39675bb030f3105489c46e
SHA1 f6913dd551a10db34afd22b4eaccd5dc9cfac300
SHA512 1bcd176c6a23a43ca5ecc0ca9f20f2e502a4fc30b41ae0ec03759d9e26346c99bb0918683d82a50b71def9d784c3cab698908b874833fea699fa01d03727fec7
MD5 SHA1 SHA512

Submit Download

svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBCCBAABBBBABCAABBBACACCACCCCACACABBAABACCAAACCCBB.exe
Size 16.1MB
SHA256 2a016f743b423474db6b5c6ac91e506b8958d2cc659bd8be93720da209219413
MD5 0569dbd7d2e6813d9b6f4a804fbd04bb
SHA1 1715cd7fc753e2401db2d88069b4401d32d88e30
SHA512 a2d989f33c21f8e750ffa080c77cce9644cf703d8cdd5968051ba4a776a13309a3cc623ae1e226385b6f8de810b5d19ff4486cf10de93d74389f6727edd0ac22
SSDEEP 196608:b7APhNNECwHrc8u3x3AEcq/fByuKlWH3CToug:bahvQHrc8u3xXJ/f4uUWHl
TLSH
T1B207AE17B34681E6C02AD2B88A478327D7B5BC440330A7DB66D5B76A2F37BE4573A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1048-80-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/1560-74-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/1584-7-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/1584-0-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/3196-26-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/3196-39-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/3472-60-0x0000000005830000-0x0000000005831000-memory.dmp

Download