Overview

overview

10

Static

static

10

2026-09-10...a-.exe

windows10-2004-x64

9

2026-09-10...a-.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 14:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
  • Size 14.4MB
  • Sample260910-rb5k9avbjd
  • SHA256 3dd860a902be21e95a0b6617cfd2e252eac09dc07c036b86c1afb93ab4a2bc58
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoverypersistence

Malware Config

Signatures

  • Detects executables packed with Dotfuscator 1 IoCs
  • Detects executables packed with SmartAssembly 1 IoCs
  • Detects executables packed with Yano Obfuscator 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2444
    • \??\c:\users\admin\appdata\local\temp\2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      c:\users\admin\appdata\local\temp\2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=107.294.200 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x7ff637875960,0x7ff637875970,0x7ff637875980
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4516
    • \??\c:\users\admin\appdata\local\temp\2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_2444_WLWXKPUXXTDMBYWU" --sandboxed-process-id=2 --init-done-notifier=804 --sandbox-mojo-pipe-token=16464116135749131299 --mojo-platform-channel-handle=780 --engine=2
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:444
    • \??\c:\users\admin\appdata\local\temp\2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe
      "c:\users\admin\appdata\local\temp\2026-09-10_8bcd4f75e19954884b16658bdcdac28f_amadey_cobalt-strike_glassworm_hijackloader_icedid_luca-.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_2444_WLWXKPUXXTDMBYWU" --sandboxed-process-id=3 --init-done-notifier=1012 --sandbox-mojo-pipe-token=11489369533620077707 --mojo-platform-channel-handle=1008
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:828

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        software_reporter_tool-sandbox.log
        • Path C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log
        • Size 1KB
        • SHA256 c06c137acc617b858e2f812faf4b461f11623917b882fecd9fa3a04601b66dc7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        edls_64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\edls_64.dll
        • Size 449KB
        • SHA256 0ce49dc9f71360bf9dd21b8e3af4641834f85eed7d80a7de0940508437e68970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        em000_64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\em000_64.dll
        • Size 37KB
        • SHA256 8b0613b91229c98dfa5398568a4fa40dde2a2d40028654f74923bc929d6b5b30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        em001_64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\em001_64.dll
        • Size 378KB
        • SHA256 a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        em002_64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\em002_64.dll
        • Size 2.3MB
        • SHA256 bb1733b7cb012f8b7d6cd0347283a549ffeab7beb4b3d0168e0d8c9cecdef8eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        em003_64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\em003_64.dll
        • Size 1.3MB
        • SHA256 ebfeeac7733a77a1e32995d638d67d2e05eefdbb62782053d8354959e046d0fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        em004_64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\em004_64.dll
        • Size 6.1MB
        • SHA256 d4f17bd032ead2a73340e6c14e24a3fa901d0fbae78f49fe4d368a01b788b49c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        em005_64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\em005_64.dll
        • Size 576KB
        • SHA256 1072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat
        • Path \??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
        • Size 40B
        • SHA256 ff8ca066af156555aa57e863c64eb2ec873b61bda2cf3b6dd39d8e7460f954ce
        • MD5 SHA1 SHA512
        Submit Download

        memory/444-4-0x00007FFCF6C70000-0x00007FFCF6C71000-memory.dmp
        Download

        memory/444-3-0x00007FFCF5FA0000-0x00007FFCF5FA1000-memory.dmp
        Download