33a1426e77afe970b10b798f03e563ccd845adb1ce05bf17049da6de3bf94bd7

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_43806a931cc536f0b84d55559c9e0ae6_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloa.exe
Size 41.3MB
Sample260807-a75sfsvbrb
SHA256 33a1426e77afe970b10b798f03e563ccd845adb1ce05bf17049da6de3bf94bd7
MD5 43806a931cc536f0b84d55559c9e0ae6
SHA1 d702661b522351e0232384afe7d32b26ab81e2eb
SHA512 4d4233c0e87eba079491d3f8055390c12a01240d8c0a644ece2b12abc4e415d081772d3c320d8803b3a5c52b8b3952b4e34e115ebe01d9d8209260d2b064f00a
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUzFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUw8:i33333333s133333333sEmHN6+Jrvv
TLSH
T14B97C046FD8B50F4EC7AA17048A7D336C9327D378031874BA6DDB6062F33A616C1A667
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c53a-19.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
252	svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe
760	svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe
4868	svchost_BCCAACCCACACCCAAAABACBACABABCCABBBBBACBCCBAACABCCBCACAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBBABAABCCABBBCCABAABAAAACABCCBBABBCBCBBACBBABCBCBCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe"	2026-08-06_43806a931cc536f0b84d55559c9e0ae6_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCACAAACBACBCACBBBBCBCACCBBCCAACBCBCCCCCCCBCABBBBBAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCAACCCACACCCAAAABACBACABABCCABBBBBACBCCBAACABCCBCACAA.exe"	svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4108	sc.exe
5704	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6140	cmd.exe
5936	cmd.exe
836	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCAACCCACACCCAAAABACBACABABCCABBBBBACBCCBAACABCCBCACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_43806a931cc536f0b84d55559c9e0ae6_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4952	2026-08-06_43806a931cc536f0b84d55559c9e0ae6_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloa.exe
4952	2026-08-06_43806a931cc536f0b84d55559c9e0ae6_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloa.exe
4952	2026-08-06_43806a931cc536f0b84d55559c9e0ae6_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloa.exe
4952	2026-08-06_43806a931cc536f0b84d55559c9e0ae6_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloa.exe
252	svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe
252	svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe
252	svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe
252	svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe
4868	svchost_BCCAACCCACACCCAAAABACBACABABCCABBBBBACBCCBAACABCCBCACAA.exe
4868	svchost_BCCAACCCACACCCAAAABACBACABABCCABBBBBACBCCBAACABCCBCACAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	2026-08-06_43806a931cc536f0b84d55559c9e0ae6_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloa.exe
Token: SeDebugPrivilege	252	svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe
Token: SeDebugPrivilege	4868	svchost_BCCAACCCACACCCAAAABACBACABABCCABBBBBACBCCBAACABCCBCACAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 6140	4952	2026-08-06_43806a931cc536f0b84d55559c9e0ae6_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloa.exe	92
PID 6140 wrote to memory of 1760	6140	cmd.exe	94
PID 252 wrote to memory of 1900	252	svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe	95
PID 4952 wrote to memory of 5936	4952	2026-08-06_43806a931cc536f0b84d55559c9e0ae6_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloa.exe	96
PID 5936 wrote to memory of 5704	5936	cmd.exe	98
PID 4952 wrote to memory of 836	4952	2026-08-06_43806a931cc536f0b84d55559c9e0ae6_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloa.exe	99
PID 836 wrote to memory of 4108	836	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-06_43806a931cc536f0b84d55559c9e0ae6_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloa.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_43806a931cc536f0b84d55559c9e0ae6_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloa.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAABACABBBCACCBBBAAACCBBCCBBAABACBBBBCCBBACAACCAAABBBBAABACCABBBCCACBAABCCBCBCBBCCAAACACCACACCACCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAABACABBBCACCBBBAAACCBBCCBBAABACBBBBCCBBACAACCAAABBBBAABACCABBBCCACBAABCCBCBCBBCCAAACACCACACCACCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBACABCCABBBCBACABCABACAABBCCBCACABCBBCCBCBBACBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe" start= auto displayName= "UserDataSvc_CCBACABCCABBBCBACABCABACAABBCCBCACABCBBCCBCBBACBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBACABCCABBBCBACABCABACAABBCCBCACABCBBCCBCBBACBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe" start= auto displayName= "UserDataSvc_CCBACABCCABBBCBACABCABACAABBCCBCACABCBBCCBCBBACBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBACABCCABBBCBACABCABACAABBCCBCACABCBBCCBCBBACBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBACABCCABBBCBACABCABACAABBCCBCACABCBBCCBCBBACBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:252
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe
1⤵
- Executes dropped EXE
PID:760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACCCACACCCAAAABACBACABABCCABBBBBACBCCBAACABCCBCACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACCCACACCCAAAABACBACABABCCABBBBBACBCCBAACABCCBCACAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e46a53427d2e5312a023b3153c32801c2dc067cfd9b710702d503a327b2f0067
MD5 8dc332398d303dffb7f00cb969a7aa16
SHA1 75b63bc32771af1fe23ce282ae4fe5ba3793a4ce
SHA512 d985e4fd903a4bd775c2b85a6e0b9734d97ebde0101e2cb10a0fd17985fcb9ee739cff40c8837a1c695c3a3d09164335f2864fd6ca866f45a5e964993ea02f8b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 049509768bf818e0ca40ef986f7c6908c2236ac1b5b93d301cecacc9b70b535a
MD5 d3b01c44b3f0df1905f9d141dfcedef5
SHA1 6cbb47ff34ecd8c1ebd7c764f853b02788584edd
SHA512 37bb20b6dd093b6c51a6c40dd1beb8596ab21d56f43df4d6caeabbe3d9e56b709cbf72a3ac63d540f0ab85d975a8d5a11b0448f11649d6a278d8c7b1881fac40
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e09b5733aff36555220ca6d2a3aa9234d7afb60e91d64211069ebb0aa86ae58b
MD5 5d3d538d11a27d250984b8fb1f785d04
SHA1 89b6912483ad75396bdb4a6612fc60abc8fdca95
SHA512 cf8d0e535b20d6416428ac9dbee7e24d914ee933a21c6497c39be0aa898e73635c0f1ef1fb1b336d12a56098060dc929cf25a6399d13c6de7dfe7a5732928402
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 27d3b5cfc0af439f85893bc2205132c0a8d5ecd5fca7b1ef0b96116469a47518
MD5 3c52dd8bd8aa0439ca0ef0728d67679f
SHA1 cba1d25a077122be20daace74c13d32685d0f6e5
SHA512 d66e4c92b68a79949f4046545744f27366ccf329e49849d61fcac39b953f994d355cc5fd09613cb6691bae50f701cc185697342181723505d0a5b01d73d6a27a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f5877deaad0fc9d1d9c70583c731859524bee802a1e1318d2ff0e7d542ce5861
MD5 60cbb420b2d7bce9f80c32d772349744
SHA1 22fa46803f5dfea8bdc1c26cf151c6b0d8f6f793
SHA512 f74f3abf86e93453ec6fc5570365168123164f36802ce3374b9fb8b525aa220c123a9e659e82a3440bafa1c0a8e921c27eda0865e1da1919221d5d2298445642
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 48e09833d41177e723d9d4c39e20250b8868351daa4d0fc5bd24499d4d477b49
MD5 3baf13d4b2d6371312c42fc2ef7401aa
SHA1 824cb5d56e13204ce470e75443f37804faf06863
SHA512 19f806ff3e5e016e557153c68bd9262db8a54fbbb9c6d753a3d4e6f5b72f2510186299021ecf874644a108c63ab662153f5c019d535e964b39150a91d68b842c
MD5 SHA1 SHA512

Submit Download

svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCABACCACBCACCBACCBBCACBABBBCCACABABBCABCCBCCACAACB.exe
Size 41.3MB
SHA256 33a1426e77afe970b10b798f03e563ccd845adb1ce05bf17049da6de3bf94bd7
MD5 43806a931cc536f0b84d55559c9e0ae6
SHA1 d702661b522351e0232384afe7d32b26ab81e2eb
SHA512 4d4233c0e87eba079491d3f8055390c12a01240d8c0a644ece2b12abc4e415d081772d3c320d8803b3a5c52b8b3952b4e34e115ebe01d9d8209260d2b064f00a
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUzFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUw8:i33333333s133333333sEmHN6+Jrvv
TLSH
T14B97C046FD8B50F4EC7AA17048A7D336C9327D378031874BA6DDB6062F33A616C1A667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 9d340926bb43ebb51958b5fadd706066ad4627c1a791724ba4aabadc19d946c4
MD5 463e01bf916d7bfa8fa01df581bf5a54
SHA1 3d3175cc6fb8fa1caf0f00430ac764393227c822
SHA512 2c9bd5b17821f58c05effb5e5027fdf676324aff55c936368f400c9f8eccff8fc927778ad181dbdc4a52ca953fc322059e9385d0e331c4db5147e1f1400ff4d2
TLSH
T15E112B24A0EACC33E53224DF4A1EEF428DD5375FAC9C6A242308D71C6B94D31CE558E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/252-23-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/252-36-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/760-67-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/4868-81-0x0000000000220000-0x0000000000241000-memory.dmp

Download

memory/4952-0-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/4952-7-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download