be80049497a26d2db9c0fdb6d51bbb7fcb249de8e1711854b965f6264f21c3c6

General

Target
2026-09-10_7c27a6c3bd3ae668d6d6818e51fc155b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Size 50.1MB
Sample260910-sbg1mayyes
SHA256 be80049497a26d2db9c0fdb6d51bbb7fcb249de8e1711854b965f6264f21c3c6
MD5 7c27a6c3bd3ae668d6d6818e51fc155b
SHA1 ac8756c7d835a7bb359015013665ecbf2cd13f68
SHA512 3e150c5f4f04e1f1c2fca0bb0684b749409bad39d1871d92f60b6572e60466c14574ab8270cc33d6d9881e4f52d48dca9429cc040e56562dfbdd2e1e13dce6ef
SSDEEP 393216:5mHN6+JrvPUmHN6+JrvPUmHN6+JrvPUmHN6+JrvPUmHN6+JrvPZ5:MbrlbrlbrlbrlbrZ5
TLSH
T13EB76B5A62AB20F9D4AFD075C5A68332D6717C23073157DB127CCA3E2F676906D38B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
3452	svchost_CCAAABBACCCBBCBCCACBCBACCABAACBBABBCAAABCACBAABCACBACAA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBBCCABBBABCBBBBBCACCBABBBCCBBBBACBBABCBBABCBBBCAACBBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAAABBACCCBBCBCCACBCBACCABAACBBABBCAAABCACBAABCACBACAA.exe"	2026-09-10_7c27a6c3bd3ae668d6d6818e51fc155b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4540	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4204	cmd.exe
1668	cmd.exe
1336	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_7c27a6c3bd3ae668d6d6818e51fc155b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAAABBACCCBBCBCCACBCBACCABAACBBABBCAAABCACBAABCACBACAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2796	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4208	2026-09-10_7c27a6c3bd3ae668d6d6818e51fc155b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
4208	2026-09-10_7c27a6c3bd3ae668d6d6818e51fc155b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
4208	2026-09-10_7c27a6c3bd3ae668d6d6818e51fc155b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
4208	2026-09-10_7c27a6c3bd3ae668d6d6818e51fc155b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
3452	svchost_CCAAABBACCCBBCBCCACBCBACCABAACBBABBCAAABCACBAABCACBACAA.exe
3452	svchost_CCAAABBACCCBBCBCCACBCBACCABAACBBABBCAAABCACBAABCACBACAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4208	2026-09-10_7c27a6c3bd3ae668d6d6818e51fc155b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Token: SeDebugPrivilege	3452	svchost_CCAAABBACCCBBCBCCACBCBACCABAACBBABBCAAABCACBAABCACBACAA.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 4204	4208	2026-09-10_7c27a6c3bd3ae668d6d6818e51fc155b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe	98
PID 4204 wrote to memory of 2796	4204	cmd.exe	100
PID 4208 wrote to memory of 1668	4208	2026-09-10_7c27a6c3bd3ae668d6d6818e51fc155b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe	101
PID 1668 wrote to memory of 4540	1668	cmd.exe	103
PID 4208 wrote to memory of 1336	4208	2026-09-10_7c27a6c3bd3ae668d6d6818e51fc155b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-09-10_7c27a6c3bd3ae668d6d6818e51fc155b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_7c27a6c3bd3ae668d6d6818e51fc155b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBCACBABBCCBACACBBCAACCABCCCCCBABCBCBCBACCABABCBBABAAAABCBABCAACCCACCBAABAABABACBAABACBACBBCBCCABBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBACCCBBCBCCACBCBACCABAACBBABBCAAABCACBAABCACBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBCACBABBCCBACACBBCAACCABCCCCCBABCBCBCBACCABABCBBABAAAABCBABCAACCCACCBAABAABABACBAABACBACBBCBCCABBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBACCCBBCBCCACBCBACCABAACBBABBCAAABCACBAABCACBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABBACCBCACAAACAABBBCCAAABABBACABBAABAABAAACBCACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBACCCBBCBCCACBCBACCABAACBBABBCAAABCACBAABCACBACAA.exe" start= auto displayName= "UserDataSvc_BAABBACCBCACAAACAABBBCCAAABABBACABBAABAABAAACBCACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABBACCBCACAAACAABBBCCAAABABBACABBAABAABAAACBCACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBACCCBBCBCCACBCBACCABAACBBABBCAAABCACBAABCACBACAA.exe" start= auto displayName= "UserDataSvc_BAABBACCBCACAAACAABBBCCAAABABBACABBAABAABAAACBCACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABBACCBCACAAACAABBBCCAAABABBACABBAABAABAAACBCACAC"
  2⤵
  - Executes a command shell one-liner
  PID:1336

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBACCCBBCBCCACBCBACCABAACBBABBCAAABCACBAABCACBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBACCCBBCBCCACBCBACCABAACBBABBCAAABCACBAABCACBACAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6a7677e781b522076efe4d3733d843f38fa7244de9b2bfbdaaf7e08a623eb471
MD5 3694e3332b31beabf5e0565d7293dc40
SHA1 003c98bf3e5015fa9d0a8666012caadbb443262d
SHA512 7bf9771b48c4ad3ff0fb31ac88321f68c801789fee11c9ad5735ac000ffa1bac57c70c9c69891ee7ba66386bf7cfdba4e3a91bff9abf2f0a749e9667ead58969
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 da9b60792cd9c42d1bf6e47067dbcfe15db6f324e6c55621b500e6c6ae2c0c03
MD5 b96e9e30627b516a95dd7051284de722
SHA1 441c8eb8b93edaa1ca5cecf65d7984e69a779a50
SHA512 da59bc0f9ae6ed0ea19d168f338855a0cb3a1bf1346905042f08ed466818374c9266a02ce175bd303e0ea4679def63034ea068ef08eef53a3fab3616248f0b15
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 da72a3e5f56887330501a9d0b3e5d0e996429626350e5282db4bed707f60ce7d
MD5 8d3643cd3571a057ccac8bcfd211305b
SHA1 b8747398f06dd3031e1c91371bd2363c910b7dc6
SHA512 49bb681c269fd881509e753916ac56c845fc4eeaf000e26c3a5e7cbcd75f044e402096be2e52465eb38a21d59f7b47fab4ff384d33a11183ff56394dd754882a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 029b4255ccdb7a019cebbabcf32110f3de2091967680fd777d916b57feb13ca0
MD5 2ddb351cac9195cd7e7b4a5578933149
SHA1 ad04a9ecdcf23c1bd0caf38198765f0318b5adb4
SHA512 d128880180088a5c871c0760d0ea9d5d188c5ad28fcb4044d1add2439df810c235e18d602f71ce68ba39955d7f48e42f39fbae5676e91ad627cffbd4aea2ad4f
MD5 SHA1 SHA512

Submit Download

memory/3452-28-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/3452-41-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/4208-0-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/4208-8-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads