111104e87dd7ece9f86ba19407a1a44262b70ee72c05dacb424ad211a029937b

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_8bce7254046f96968d80f06b879fb73c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Size 14.7MB
Sample260910-rbyspsdj5s
SHA256 111104e87dd7ece9f86ba19407a1a44262b70ee72c05dacb424ad211a029937b
MD5 8bce7254046f96968d80f06b879fb73c
SHA1 cfe8d99da1a1b4d1d42348469408ba51f4471268
SHA512 11168629230c62c8ed61498a7ef92ca3909ced363109f58478a729968493600ef72773f8dd41033bbb68b2c15619ced7105de3bcbd3f663b71f3e76b9db688ec
SSDEEP 196608:E7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouw:EahvQHrc8u3xXJ/f4uUWHh
TLSH
T12EF69E17B35681E6C02AE2B88A474212D7BA7C440334B7DB12E5B7692F77BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c517-21.dat	INDICATOR_EXE_Packed_Dotfuscator

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c517-21.dat	INDICATOR_EXE_Packed_SmartAssembly

Detects executables packed with Yano Obfuscator 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c517-21.dat	INDICATOR_EXE_Packed_Yano

Executes dropped EXE 2 IoCs

pid	Process
3108	svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe
1212	svchost_CAACACAACCBACACACCAACBBAACBBAABABBBCBCBBABBAACBAABCBBCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABBCCABABBACBCAACACCBABBCBBCBACCBCCBBCBACBBBBAABACCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe"	2026-09-10_8bce7254046f96968d80f06b879fb73c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBBBABABAAAACCBAAAAAACAACCCABBCCBBABABBABCCCBCBABCBACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACACAACCBACACACCAACBBAACBBAABABBBCBCBBABBAACBAABCBBCC.exe"	svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1160	cmd.exe
3960	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_8bce7254046f96968d80f06b879fb73c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACACAACCBACACACCAACBBAACBBAABABBBCBCBBABBAACBAABCBBCC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4572	2026-09-10_8bce7254046f96968d80f06b879fb73c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
4572	2026-09-10_8bce7254046f96968d80f06b879fb73c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
4572	2026-09-10_8bce7254046f96968d80f06b879fb73c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
4572	2026-09-10_8bce7254046f96968d80f06b879fb73c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
3108	svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe
3108	svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe
3108	svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe
3108	svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4572	2026-09-10_8bce7254046f96968d80f06b879fb73c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Token: SeDebugPrivilege	3108	svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 1160	4572	2026-09-10_8bce7254046f96968d80f06b879fb73c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	92
PID 1160 wrote to memory of 4128	1160	cmd.exe	94
PID 3108 wrote to memory of 1548	3108	svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe	95
PID 4572 wrote to memory of 3960	4572	2026-09-10_8bce7254046f96968d80f06b879fb73c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-09-10_8bce7254046f96968d80f06b879fb73c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_8bce7254046f96968d80f06b879fb73c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBBCBAABABACBCABBBCBABCAABAAABBCCBACBABCBABBCAACBBABCABAABBABBAABCCCAABCCBCCAAABCCACCCACCCABACCAACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBBCBAABABACBCABBBCBABCAABAAABBCCBACBABCBABBCAACBBABCABAABBABBAABCCCAABCCBCCAAABCCACCCACCCABACCAACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACACCACCCBABBBACBBABCCABBBCABBAAABCCABACCAAABACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe" start= auto displayName= "UserDataSvc_AACACCACCCBABBBACBBABCCABBBCABBAAABCCABACCAAABACACC"
  2⤵
  - Executes a command shell one-liner
  PID:3960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1548

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACACAACCBACACACCAACBBAACBBAABABBBCBCBBABBAACBAABCBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACACAACCBACACACCAACBBAACBBAABABBBCBCBBABBAACBAABCBBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f4080a314b3b626c5076e84ff6a1c30b62a23adb1acac65c9728ef0eadbd1245
MD5 12ada0d3683be2fdd3706bfa105ab201
SHA1 7f7c297c7cf64e08c54a3c5fe469d8810cb6cf61
SHA512 530e2374d4d6b6b68e7d66b5c2039d70160ecb89e21635ed162fbdf99213f9171422ac88192eb173beb5e54eb1b96ce6a05417e7659cf9f3624e0909fc916273
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0f991b9384444d556fd18a546481d96245dd85ca82ae00a70963bf1c368a1adf
MD5 c353c6e48e0b3fbeaaecc439607b4800
SHA1 2520055d642b2cb662490178e2c4c83be937ce09
SHA512 8b508aa2a9cb7f3f09314d57330fc62ae2032bd6180858ac85004621d4a8661506b623ece79be3fb0087427ab92569fbe1b4f4c917ab87479ffe9ec747bb6419
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b8bf2c32f6ced8da8e942866876148f868ba0419823263b76979cd84e29a3f7
MD5 dc09d73127d8e1a8adf1a53f14fc93e9
SHA1 4e128ab75b0583e2426aed36a8bcc390cb192597
SHA512 904405dc44f8497e74da4923984ae5a57f9179cb6dd7597f095b8f708d05d71e87ba214baad10cbfe374cf7455a931d0b9cb0c1fe8d601023f8e349f1e8ca04e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dc9a5da3996bcaa76d68f50477c32f8266abecf3b7e54e1735f87ff0e063d7f1
MD5 cc43dfabd8ef6b98bf65d03f1ce69daf
SHA1 f524f9ea694f1d15af5add610e0287d54e9ed247
SHA512 99e0582e05a4b561093e51de584d6ad1c4c536d55387c2671f5cca03844e4149f18022dbdf6def5f904eaefc0ed3ea44452fa5606104dd9b1dc374ac5f98ae34
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 92f570762827ea3db9ecfe64f263e5ee31549b13f7d7e0feee75f5118be140c6
MD5 abc2e7ba5b68ff25dc83e0fd2418da71
SHA1 d54ace9aab78237f7f497a78ba04a09d1e632d56
SHA512 5d5ee2b21181d81f71ec337e8e1716b476ddb074e6df8f226192de26cf0ddeb47a70176deef780d800513210835a60496884384058e55ef6d67954133b1bb011
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5decc105b80b39143c28193ae14497ae2864a621e16943fd17b66c73ea521933
MD5 e0d950afb5aa1d19d2b35153d8a2040a
SHA1 63f89c9e5015797c15bce4846886ce394e08fc36
SHA512 2eb5577b58620c191e16595d64dd9148504eb43d36aebb120e6e7dc607f99d052e6a90bc8034047c8a989ee226f578055c3d175c09e0e933507f6af1f785d2d0
MD5 SHA1 SHA512

Submit Download

svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBACABBBCBABACCABCCCAACCCCBBBCACAABCBCCCBBAAACCBBAB.exe
Size 14.7MB
SHA256 111104e87dd7ece9f86ba19407a1a44262b70ee72c05dacb424ad211a029937b
MD5 8bce7254046f96968d80f06b879fb73c
SHA1 cfe8d99da1a1b4d1d42348469408ba51f4471268
SHA512 11168629230c62c8ed61498a7ef92ca3909ced363109f58478a729968493600ef72773f8dd41033bbb68b2c15619ced7105de3bcbd3f663b71f3e76b9db688ec
SSDEEP 196608:E7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouw:EahvQHrc8u3xXJ/f4uUWHh
TLSH
T12EF69E17B35681E6C02AE2B88A474212D7BA7C440334B7DB12E5B7692F77BE45B3B350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-65-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/3108-35-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/4572-0-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/4572-8-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download