764ccbc08ba997ba9f1f913778aa1e9dc4ce9a7fc2e2b2da47254913a45f84cd

General

Target
2026-09-28_9e7ca2a7306a48eb3d39ea74f04dacfa_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe
Size 5.2MB
Sample260928-qmapksvemf
SHA256 764ccbc08ba997ba9f1f913778aa1e9dc4ce9a7fc2e2b2da47254913a45f84cd
MD5 9e7ca2a7306a48eb3d39ea74f04dacfa
SHA1 7ab02115f33e185ab2ce187a1ac7c289388abc88
SHA512 e58fd4e7863df5495e22370e08debdb1c28533d1a51b06df2f7b092f5f5afbd47194842d7223b38b88f037f598c802cf4c10de415b5ffeefa91494903e743683
SSDEEP 98304:tVMDtIXLr06AdfEThF35PzuIcymc620c+aDBpRB:prmEdF3lcymDE5DBp7
TLSH
T19346D01693FE00E9D1BBD1BE8A038517EAB1781D0B3356DB05709A5B6F7BAD04E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4936	2026-09-28_9e7ca2a7306a48eb3d39ea74f04dacfa_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe
2508	maintenance.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2428	cmd.exe
4596	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenance.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_9e7ca2a7306a48eb3d39ea74f04dacfa_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5904	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5768	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4936	2026-09-28_9e7ca2a7306a48eb3d39ea74f04dacfa_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2428	4916	2026-09-28_9e7ca2a7306a48eb3d39ea74f04dacfa_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe	89
PID 4916 wrote to memory of 4596	4916	2026-09-28_9e7ca2a7306a48eb3d39ea74f04dacfa_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe	91
PID 2428 wrote to memory of 1688	2428	cmd.exe	93
PID 4596 wrote to memory of 5064	4596	cmd.exe	94
PID 2428 wrote to memory of 5768	2428	cmd.exe	95
PID 4596 wrote to memory of 4936	4596	cmd.exe	96
PID 4596 wrote to memory of 5904	4596	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-09-28_9e7ca2a7306a48eb3d39ea74f04dacfa_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_9e7ca2a7306a48eb3d39ea74f04dacfa_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zbe2026928132217569.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks.Exe /delete /tn "Maintenance" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1688
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks.Exe /create /tn "Maintenance" /xml "C:\Users\Admin\AppData\Local\Temp\zx2026928132217569.xml"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zb2026928132217569.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\2026-09-28_9e7ca2a7306a48eb3d39ea74f04dacfa_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-28_9e7ca2a7306a48eb3d39ea74f04dacfa_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4936
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5904

C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zb2026928132217569.bat

Path C:\Users\Admin\AppData\Local\Temp\zb2026928132217569.bat
Size 904B
SHA256 8f12e52db3829455b247b9439b7ebda4bc9bb6fb83af950fe7fcef2fc208adab
MD5 4644bce898eca8b66b355f594cc35fe6
SHA1 c1ed9a80d4b9e280ad8f41c26713ad6067bd5c8f
SHA512 97b07e1f0bcdd09753d1c1be07a1385ba827474b6c432b55deb75c32fc882fbfd27f332dcb58787bba082c64f957e19b52a55cc5ea0c7088e667afeed2607b27
TLSH
T17C115C05C9AACBF90419A0978AB5AECDC1742E4D2F0537288792CA0D66D7C0FE7D2386
MD5 SHA1 SHA512 TLSH

Submit Download

zbe2026928132217569.bat

Path C:\Users\Admin\AppData\Local\Temp\zbe2026928132217569.bat
Size 366B
SHA256 ddc4f59d82a1baf53b62862457a2b441ae95fdf5cb199c6ebe6108c6b9fdf73c
MD5 2d16ff99c93dc0a29951ca196dc6d8fa
SHA1 fc173e700b2c516c50152703bb8d0f6373f24546
SHA512 f6c1b97cf569055a0439ffbb548ef73f8e306b15a7e6e36fea6c20c2c73238f46f64ef7a47e4fcbd6fbec38bb5bb112eefa2dcc41006ff8890867990d924f217
TLSH
T1CDE0680803A7C099900CE20379DB2A1368B1606AA7E233282EC711208A8B149F8AF703
MD5 SHA1 SHA512 TLSH

Submit Download

ze2026928132217569.tmp

Path C:\Users\Admin\AppData\Local\Temp\ze2026928132217569.tmp
Size 5.2MB
SHA256 c6e30b14013486ee4ede0f046e8b1113b0c1923a3ed2e7add7639797628bb37b
MD5 b7b89831bc760dccb04a1b9cf2f9ccf7
SHA1 eb22f054a7a30bbef2922e25ea64c64633a66031
SHA512 35e586ca58a4817f2bebc1892ba81651549b76e26a978b59b5535baa7af6977912a21e211ca2a57b261d0d9e7186971a77cd992cb6648fef868e43e719097586
SSDEEP 98304:+cymc620c+aDBpRK7XsWkkjaHjTo82Pb0cT:+cymDE5DBpg8Wfse
TLSH
T15346C01693EE00E9D1BBD1BE8A078516EAB1780D0B3356DB05709E5B6F7BBD04E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zx2026928132217569.xml

Path C:\Users\Admin\AppData\Local\Temp\zx2026928132217569.xml
Size 1KB
SHA256 29e404266abb00eb2ebf1994d38c37372c41c849ca1270a02a6ed8051123d01e
MD5 08ff5e54cd840e2dd4931f688d6c4596
SHA1 c95086d8660586ecd2cc1e1449e351d2af4cac43
SHA512 5f0c9abfc86072d26df3361f07e70465d28ba5eb38dfa1574c909728beda7eba6309ad12484590b8287d0421142879caef7578f66501b5538c868970f8b72cae
TLSH
T1F831E3589CC0B72BB533922BE7515282EF758393496A4028F4CC4B7B2FF51466153563
MD5 SHA1 SHA512 TLSH

Submit Download

maintenance.exe

Path C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
Size 2.2MB
SHA256 a77315296dc58edac4959c9ed69ec96e9517883684edaeba3e64c48a44c186ae
MD5 73ad6d009f1c53c23f5d068caa805299
SHA1 f50493f49c3b2b3697b5eb571738dbc70383cac0
SHA512 1f9c739c7b745ba57b3d7e50e00bac9d3019de25aab5bb22c0da810d963dab93d71c56686fccf737cf87a4c95fe53b8e4b3dda09ac1526fb4899aa0e1336e920
SSDEEP 49152:uo7TN6XYwGRV1LCnO9DivWp1daCCN2eLF6I5YDPRrBdSm2610V+9dmhBafgE:uC6NIDLCCiO/dat6I5YPFBx0VmKafgE
TLSH
T184B5337F996640A6FEB86ABC24127F7C892BD12703306D71D9D59C37045E223AB324ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads