Overview

overview

10

Static

static

10

2026-09-10...a-.exe

windows10-2004-x64

9

2026-09-10...a-.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 14:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
  • Size 14.4MB
  • Sample260910-rb5k9avbjd
  • SHA256 3dd860a902be21e95a0b6617cfd2e252eac09dc07c036b86c1afb93ab4a2bc58
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoverypersistence

Malware Config

Signatures

  • Detects executables packed with Dotfuscator 1 IoCs
  • Detects executables packed with SmartAssembly 1 IoCs
  • Detects executables packed with Yano Obfuscator 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4532
    • \??\c:\users\admin\appdata\local\temp\2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      c:\users\admin\appdata\local\temp\2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=107.294.200 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff645675960,0x7ff645675970,0x7ff645675980
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4772
    • \??\c:\users\admin\appdata\local\temp\2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_4532_ETCVGNJKZVJCVLTU" --sandboxed-process-id=2 --init-done-notifier=764 --sandbox-mojo-pipe-token=8365553464028720254 --mojo-platform-channel-handle=740 --engine=2
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:4584
    • \??\c:\users\admin\appdata\local\temp\2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_4532_ETCVGNJKZVJCVLTU" --sandboxed-process-id=3 --init-done-notifier=984 --sandbox-mojo-pipe-token=1717592255301223789 --mojo-platform-channel-handle=980
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:752

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        software_reporter_tool-sandbox.log
        • Path C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log
        • Size 3KB
        • SHA256 76a8540709db676d404701ca2816ee7ae36c6c71d951b0ff6cce159a728984ab
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        edls_64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\edls_64.dll
        • Size 449KB
        • SHA256 0ce49dc9f71360bf9dd21b8e3af4641834f85eed7d80a7de0940508437e68970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat
        • Path \??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
        • Size 40B
        • SHA256 3613e539dca44ae79a3476d68a02fab637cbebfbe09af14e35201bf2eafd655b
        • MD5 SHA1 SHA512
        Submit Download

        em000_64.dll
        • Path \??\c:\users\admin\appdata\local\temp\em000_64.dll
        • Size 37KB
        • SHA256 8b0613b91229c98dfa5398568a4fa40dde2a2d40028654f74923bc929d6b5b30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        em001_64.dll
        • Path \??\c:\users\admin\appdata\local\temp\em001_64.dll
        • Size 378KB
        • SHA256 a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        em002_64.dll
        • Path \??\c:\users\admin\appdata\local\temp\em002_64.dll
        • Size 2.3MB
        • SHA256 bb1733b7cb012f8b7d6cd0347283a549ffeab7beb4b3d0168e0d8c9cecdef8eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        em003_64.dll
        • Path \??\c:\users\admin\appdata\local\temp\em003_64.dll
        • Size 1.3MB
        • SHA256 ebfeeac7733a77a1e32995d638d67d2e05eefdbb62782053d8354959e046d0fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        em004_64.dll
        • Path \??\c:\users\admin\appdata\local\temp\em004_64.dll
        • Size 6.1MB
        • SHA256 d4f17bd032ead2a73340e6c14e24a3fa901d0fbae78f49fe4d368a01b788b49c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        em005_64.dll
        • Path \??\c:\users\admin\appdata\local\temp\em005_64.dll
        • Size 576KB
        • SHA256 1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/752-50-0x00000234824A0000-0x00000234824F5000-memory.dmp
        Download

        memory/4584-3-0x00007FFE8C310000-0x00007FFE8C311000-memory.dmp
        Download

        memory/4584-4-0x00007FFE8C9E0000-0x00007FFE8C9E1000-memory.dmp
        Download

        memory/4584-49-0x0000018823870000-0x00000188238C5000-memory.dmp
        Download