12ffc2aa86d40b12fa37427e0d05087fbcfdea83fa70bcd16830f22c4624d185

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_aabc98032dcead3d871e3b8974de1515_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 8.4MB
Sample260810-ckghfss1fz
SHA256 12ffc2aa86d40b12fa37427e0d05087fbcfdea83fa70bcd16830f22c4624d185
MD5 aabc98032dcead3d871e3b8974de1515
SHA1 12116839d0455f61ddb1f75bb1ed16b3cd825dcc
SHA512 81210944ba5da17d2cbd9adff4795de24730403db05f8533b6353148f7840b6efcc16c793c50a6c24cab93768e56c8f89d11df85650820c8b703bdbe8de9ba2a
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+Ef+EF+Ei+EF+Ei+EF+Ef+EF+Ei+EF+Ei+EF+Ef+EF+Ei+En:J/fh6ImzzJoDfuBcMv+A73XAZ
TLSH
T110965B05FD8744F1DA17517008DBE3BF8630BA15C222CEE7EB498F5BF923BA15829256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4372	svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBCAACCBBBACACACBBAAACBBCCCBABBCBACAAACCBCBABCABABCCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe"	2026-08-10_aabc98032dcead3d871e3b8974de1515_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1940	sc.exe
2336	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4820	cmd.exe
2200	cmd.exe
4464	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_aabc98032dcead3d871e3b8974de1515_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4040	2026-08-10_aabc98032dcead3d871e3b8974de1515_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4040	2026-08-10_aabc98032dcead3d871e3b8974de1515_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4040	2026-08-10_aabc98032dcead3d871e3b8974de1515_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4040	2026-08-10_aabc98032dcead3d871e3b8974de1515_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4372	svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe
4372	svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4040	2026-08-10_aabc98032dcead3d871e3b8974de1515_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	4372	svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 4820	4040	2026-08-10_aabc98032dcead3d871e3b8974de1515_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	91
PID 4820 wrote to memory of 2980	4820	cmd.exe	93
PID 4040 wrote to memory of 2200	4040	2026-08-10_aabc98032dcead3d871e3b8974de1515_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	94
PID 2200 wrote to memory of 1940	2200	cmd.exe	96
PID 4040 wrote to memory of 4464	4040	2026-08-10_aabc98032dcead3d871e3b8974de1515_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-10_aabc98032dcead3d871e3b8974de1515_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_aabc98032dcead3d871e3b8974de1515_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABCCCBAAACBABABBABBBBBCBABAACACBCBBBCCAABBCBBBABAABCBCBACABABCACCBBCAAAACBCCCCABABBCBAACACACBCABBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABCCCBAAACBABABBABBBBBCBABAACACBCBBBCCAABBCBBBABAABCBCBACABABCACCBBCAAAACBCCCCABABBCBAACACACBCABBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCABAAACCAAABACBACBBABCCAAABAAACACBAACCBCCAACCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe" start= auto displayName= "UserDataSvc_CBCABAAACCAAABACBACBBABCCAAABAAACACBAACCBCCAACCBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCABAAACCAAABACBACBBABCCAAABAAACACBAACCBCCAACCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe" start= auto displayName= "UserDataSvc_CBCABAAACCAAABACBACBBABCCAAABAAACACBAACCBCCAACCBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCABAAACCAAABACBACBBABCCAAABAAACACBAACCBCCAACCBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4464
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCABAAACCAAABACBACBBABCCAAABAAACACBAACCBCCAACCBABB"
    3⤵
    - Launches sc.exe
    PID:2336

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe
1⤵
PID:1560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 959c96776a50c2d154fa8746276f8f254e9a4ffe81cd9da5bd914dbd7ca8271e
MD5 797833690fbfe4a0da704364859bee2c
SHA1 160611d4cbc9f6d2973c0e1d9e52bede4c1de08f
SHA512 0b95c4aa641a5892fd566e95e70e9228d166128b1d1cbceef06718b26b9e377336de158810e3d65595071a23738f8fb8da250c3ca5564c60d79ebe5dbec5bd70
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cd58a3af57cece5bbab043110b68d13278087a2fff541654a0b810d1bce70e86
MD5 a857420547df684e574717206f2bdd79
SHA1 40b6077f6bd9cd78879d9f2612e5fdebabcd1737
SHA512 25821b00e2400e31b4f6dc60819895bd95baac980341eafb50f63273e1702626ed33a922a3f2242823dd68b8bdeb0c64d5c47591d868c8a4594f0b9573a86b8c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5bb29c770f88d7e5a5bdf9ba165312072cfa29205635e827c93b07afd799ef31
MD5 9cc4f3dc4b21ac669bf0e77094582dd4
SHA1 91ea063b64069a788f78213becc3e7610b629676
SHA512 4d7390740e845be912dccc5e70a4f5c97937937bff6da8a10cb4f10c34d49fe0276d0c69e9bd659f2cf32e9dde3de8b9697a4e51a70fd7dbe80645410fba0c34
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 37be9dca28c7d867d396777b179048a8e6bdb1365d0141cb4426d4771421b93c
MD5 fde336eaca34f3301d0c185826afc878
SHA1 27cbd29b3defbfbd7b3356baf642299c39c59deb
SHA512 9419ad254bbaeffc17c24c01c587f85a17cd3e891ae55f81747946e73995be1b5da73449b5c44aac62e72a3dd2f9d98e8f38674cf3cf188a82cd55c7295b8d5f
MD5 SHA1 SHA512

Submit Download

svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe
Size 8.4MB
SHA256 12ffc2aa86d40b12fa37427e0d05087fbcfdea83fa70bcd16830f22c4624d185
MD5 aabc98032dcead3d871e3b8974de1515
SHA1 12116839d0455f61ddb1f75bb1ed16b3cd825dcc
SHA512 81210944ba5da17d2cbd9adff4795de24730403db05f8533b6353148f7840b6efcc16c793c50a6c24cab93768e56c8f89d11df85650820c8b703bdbe8de9ba2a
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+Ef+EF+Ei+EF+Ei+EF+Ef+EF+Ei+EF+Ei+EF+Ef+EF+Ei+En:J/fh6ImzzJoDfuBcMv+A73XAZ
TLSH
T110965B05FD8744F1DA17517008DBE3BF8630BA15C222CEE7EB498F5BF923BA15829256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCAAAACAAAAACBBCBBAACACBABBACABAABACCACBBBABCBBBB.exe
Size 7.2MB
SHA256 a4005885306e82fa0f0e303349e714bd640ee41f0348ed7d44cefad8c2c0ac28
MD5 426c3d8b441e49725c07f872a93c442c
SHA1 a119eb82fb14b2243531b5a65b08fe282752ade0
SHA512 18dba5370d911be42444a67ddf2fd3fe242a52cbc7afc3e466c79f920f2852aa997762ffda933ec8dfc1b4df090f98d28b08114f2bf7afb6444bf79a90a121b7
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+Ef+EF+Ei+EF+Ei+EF+Ef+EF+Ei+EF+Ei+EF+Ef+EF+Ei+EN:J/fh6ImzzJoDfuBcMv+Ae
TLSH
T1BE763A49FD8744F1D91B54B008CBE3BF8A30BB15C225CEE7EB498F47E827BA25829155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4040-0-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/4040-8-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/4372-25-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Download

memory/4372-38-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Download