Analysis
- max time kernel
55s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 11:02
General
- Target 2026-07-29_5a2719a17677314f87b667e59e7859ed_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
- Size 3.9MB
- Sample260729-m46lsst1es
- SHA256 672bac34a637e37ca5fdab4c31b0fc526584430b26f692303ee9a26ca40ea3cd
Malware Config
Extracted
-
svcstealer
-
http://196.251.107.186/acovp/post.php
-
http://192.162.199.186/usovp/post.php
-
http://196.251.107.163/bioxp/post.php
-
build_id
SlLoaded
-
srv_delay
1
-
srv_retry
1
Signatures
- Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Downloads MZ/PE file 3 IoCs
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 8 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Detects Pyinstaller 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_5a2719a17677314f87b667e59e7859ed_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_5a2719a17677314f87b667e59e7859ed_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"2⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchlp1.exeC:\Users\Admin\AppData\Local\Temp\svchlp1.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\svchlp2.exeC:\Users\Admin\AppData\Local\Temp\svchlp2.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-90LSA22E93.tmp\svchlp2.tmp"C:\Users\Admin\AppData\Local\Temp\is-90LSA22E93.tmp\svchlp2.tmp" /SL5="$130078,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\svchlp2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchlp3.exeC:\Users\Admin\AppData\Local\Temp\svchlp3.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\svchlp4.exeC:\Users\Admin\AppData\Local\Temp\svchlp4.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\svchlp5.exeC:\Users\Admin\AppData\Local\Temp\svchlp5.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchlp5.exeC:\Users\Admin\AppData\Local\Temp\svchlp5.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Roaming\cryptsvcphg.exeC:\Users\Admin\AppData\Roaming\cryptsvcphg.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svchlp3.exeC:\Users\Admin\AppData\Local\Temp\svchlp3.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_zstd.pyd
base_library.zip
libffi-8.dll
python314.dll
svchlp2.tmp
_isdecmp.dll
svchlp1.exe
svchlp2.exe
svchlp3.exe
svchlp4.exe
svchlp5.exe
memory/3396-47-0x00007FF6B8540000-0x00007FF6B855E000-memory.dmp
memory/3396-51-0x00007FF6B8540000-0x00007FF6B855E000-memory.dmp
memory/4140-81-0x0000000000A90000-0x0000000000EA0000-memory.dmp
memory/4140-12-0x0000000000A90000-0x0000000000EA0000-memory.dmp
memory/4140-156-0x0000000000A90000-0x0000000000EA0000-memory.dmp
memory/4140-152-0x0000000000A90000-0x0000000000EA0000-memory.dmp
memory/4140-141-0x0000000000A90000-0x0000000000EA0000-memory.dmp
memory/4140-0-0x0000000000A90000-0x0000000000EA0000-memory.dmp
memory/4140-133-0x0000000000A90000-0x0000000000EA0000-memory.dmp
memory/4140-127-0x0000000000A90000-0x0000000000EA0000-memory.dmp
memory/4140-117-0x0000000000A90000-0x0000000000EA0000-memory.dmp
memory/4140-10-0x0000000000A90000-0x0000000000EA0000-memory.dmp
memory/4168-121-0x00000000002C0000-0x0000000000720000-memory.dmp
memory/4168-136-0x00000000002C0000-0x0000000000720000-memory.dmp
memory/4168-114-0x00000000002C0000-0x0000000000720000-memory.dmp
memory/4376-36-0x000001EBB2910000-0x000001EBB2942000-memory.dmp
memory/4376-134-0x000001EBB29C0000-0x000001EBB29F1000-memory.dmp
memory/5360-116-0x00000000036B0000-0x00000000036D5000-memory.dmp
memory/5360-50-0x00000000036B0000-0x00000000036D5000-memory.dmp
memory/5360-49-0x00000000036B0000-0x00000000036D5000-memory.dmp
memory/5360-119-0x00000000036B0000-0x00000000036D5000-memory.dmp
memory/5360-54-0x00000000036B0000-0x00000000036D5000-memory.dmp
memory/5360-56-0x00000000036B0000-0x00000000036D5000-memory.dmp
memory/5360-52-0x00000000036B0000-0x00000000036D5000-memory.dmp
memory/5360-55-0x00000000036B0000-0x00000000036D5000-memory.dmp
memory/5360-53-0x00000000036B0000-0x00000000036D5000-memory.dmp
memory/5360-59-0x0000000003620000-0x0000000003621000-memory.dmp
memory/5668-113-0x00000000001C0000-0x00000000002C6000-memory.dmp
memory/5668-21-0x00000000001C0000-0x00000000002C6000-memory.dmp