595573320194c4324bbf246313c94e86077edb3d7d6c90e5751fcb1ed9b8d25f

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_82228437564e6a6093fc7cede38926a6_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
Size 25.4MB
Sample260810-cs3qnazalg
SHA256 595573320194c4324bbf246313c94e86077edb3d7d6c90e5751fcb1ed9b8d25f
MD5 82228437564e6a6093fc7cede38926a6
SHA1 064ee634ad8774ba63585bfbd869ff3f7639661d
SHA512 a705cd3fe07f5c9b418e57d311c42f5d32fbe2a08850ec53605f70cc23c13372523a8272d66b05fd30054c15dd628a4e589ffaaa4ba7d0ca689575093b9da9e5
SSDEEP 196608:vBBBBWBBBBWBBBBWBBBBWBBBBWBBBBWBBBBWBBBBOHh6ImzD+Fu:sT
TLSH
T13A478D10B7D28035F5B319318ABFD33A5539B9214F2586CFE3884A3E9D72AE1A931717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1364	svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe
4448	svchost_CABABBBBBBBCACACBBCACACBACCCBAABBCABBCBABACACCABBCBBBBA.exe
3988	svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBAACCACAABABCCABCCCBBAAAACAABCCBCCCABABCCCBCCBCACCACABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe"	2026-08-10_82228437564e6a6093fc7cede38926a6_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBABCCBBCBCCCAAACCBACBCBAABCCBCBBBCABBBBBCBACABBACCBCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABABBBBBBBCACACBBCACACBACCCBAABBCABBCBABACACCABBCBBBBA.exe"	svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3352	sc.exe
3680	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1588	cmd.exe
2852	cmd.exe
2340	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_82228437564e6a6093fc7cede38926a6_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABABBBBBBBCACACBBCACACBACCCBAABBCABBCBABACACCABBCBBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2296	2026-08-10_82228437564e6a6093fc7cede38926a6_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
2296	2026-08-10_82228437564e6a6093fc7cede38926a6_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
2296	2026-08-10_82228437564e6a6093fc7cede38926a6_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
2296	2026-08-10_82228437564e6a6093fc7cede38926a6_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
1364	svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe
1364	svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe
1364	svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe
1364	svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe
4448	svchost_CABABBBBBBBCACACBBCACACBACCCBAABBCABBCBABACACCABBCBBBBA.exe
4448	svchost_CABABBBBBBBCACACBBCACACBACCCBAABBCABBCBABACACCABBCBBBBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	2026-08-10_82228437564e6a6093fc7cede38926a6_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
Token: SeDebugPrivilege	1364	svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe
Token: SeDebugPrivilege	4448	svchost_CABABBBBBBBCACACBBCACACBACCCBAABBCABBCBABACACCABBCBBBBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2992	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1588	2296	2026-08-10_82228437564e6a6093fc7cede38926a6_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe	104
PID 1588 wrote to memory of 4768	1588	cmd.exe	106
PID 1364 wrote to memory of 4820	1364	svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe	110
PID 4820 wrote to memory of 3748	4820	notepad.exe	111
PID 2296 wrote to memory of 2852	2296	2026-08-10_82228437564e6a6093fc7cede38926a6_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe	115
PID 2852 wrote to memory of 3352	2852	cmd.exe	117
PID 2296 wrote to memory of 2340	2296	2026-08-10_82228437564e6a6093fc7cede38926a6_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe	118
PID 2340 wrote to memory of 3680	2340	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-08-10_82228437564e6a6093fc7cede38926a6_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_82228437564e6a6093fc7cede38926a6_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCCACCAAAABACCACCCCBCBCCBCCABACBCACBCCBABABBABACBAAACABCBCBCABCCABABBCBAAAABCCBBABBACCBCCCCBCBACABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCCACCAAAABACCACCCCBCBCCBCCABACBCACBCCBABABBABACBAAACABCBCBCABCCABABBCBAAAABCCBBABBACCBCCCCBCBACABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACCABABAAAABCBABABBCCBBAACBBAACCBCBABCCBBCCCCABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe" start= auto displayName= "UserDataSvc_BBACCABABAAAABCBABABBCCBBAACBBAACCBCBABCCBBCCCCABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACCABABAAAABCBABABBCCBBAACBBAACCBCBABCCBBCCCCABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe" start= auto displayName= "UserDataSvc_BBACCABABAAAABCBABABBCCBBAACBBAACCBCBABCCBBCCCCABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACCABABAAAABCBABABBCCBBAACBBAACCBCBABCCBBCCCCABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACCABABAAAABCBABABBCCBBAACBBAACCBCBABCCBBCCCCABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3748

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABBBBBBBCACACBBCACACBACCCBAABBCABBCBABACACCABBCBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABBBBBBBCACACBBCACACBACCCBAABBCABBCBABACACCABBCBBBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe
1⤵
- Executes dropped EXE
PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 61758ca662b1e97087f78fd5061f66bae5512cefbfd38aa8a43d416b28fc3a55
MD5 a1ab6e36a9cc64fd6a6afe31c752de7d
SHA1 f8676f1e5498758ea0587d66cd119402c8e58d8d
SHA512 5c99c1f853decbf7ba6c9e88587105f65cd40dec1558ea6ff02626218e73448e574323f82553f01588556671d0dd40a518e4ba8a12e775af050f79717d98a505
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8ae0d7a711c7aebd8834577a973661f83edbaee29e467ca9579a212460e68e9e
MD5 1c6b3eed330d7594d35fda1fdc4240e6
SHA1 c000b8fb4d067e94b76a2eb2ff8fec0b91daf509
SHA512 9269947ee24fa97a0b3b7c53107740b5c4df7e595e8085728993176a2459c0fa37d7ba48f8db53def2cdfb16308f3ab74ded7d2670333c065e9869d8931c77cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1161d37b0c99afe1a6f412aa75b2ac5ec5db97b9b03b726445334be394999d18
MD5 072bb4d395ecff9902a12c9afefd764d
SHA1 20236be2cdd8db28100b696eb8df0e2c1487da16
SHA512 49ce5e5655cb798dc5298ffd5b876686ecf79f98a2c54d2a71ad9bed294d7556a619116790a05e3222774dabf25ffe57c6b3d6ef3cd136418451798b1909be30
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cf21782aff24208b367b9c01fcb6666867aa61a31589d9a56333fcc7527a09d0
MD5 802c84d2e7449944ddbc34d9d48743a7
SHA1 0f243009eebb0f86ef4ada59d508d7dc626aa216
SHA512 cdce643aa070d12ffe994bcf1fc10a6a0644bc515760820fb23e26901973f2bcf23028d012a505ecb5d50ca0fd30f10764d1774322a79953716396d49a0fff38
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cb455e4d8fa3f490f25622b96cb72c0f52120c0d1f5b693f1b1b4ab707a821b6
MD5 18dc02c24aada9167ee00f50e1e29678
SHA1 2f34e5912729600a1f4f24dd066b30aea061f113
SHA512 a9fc6b2779103719d295b15d4665b73f668450cf37922148d34f7f76fc563ab33d68f87ba3c0bb11e916d47497a9b8e0355d28bc5f667cbcfa3b43331c9abb6b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5c165b312b8f87be2efa9f81a985528eedc903ef9c3651f7a295ccf1015fe742
MD5 e50d6f78cc7e9a759bf4f5cc65a22bc7
SHA1 bf1ceb6167ecc9efe10a5c4cf8c711dda9630f75
SHA512 fcb5919355c0fbdb4bb067af06addbdcd7024d533fd1f1a2f2d9193178d38170a58c24ac752209754801121b1231e36b81945c4d51840089ca43d5d509004cf4
MD5 SHA1 SHA512

Submit Download

svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACBBABCACCAAACBCBAACCCCBBBCBCBBABACCAACBABBBCABCB.exe
Size 25.4MB
SHA256 595573320194c4324bbf246313c94e86077edb3d7d6c90e5751fcb1ed9b8d25f
MD5 82228437564e6a6093fc7cede38926a6
SHA1 064ee634ad8774ba63585bfbd869ff3f7639661d
SHA512 a705cd3fe07f5c9b418e57d311c42f5d32fbe2a08850ec53605f70cc23c13372523a8272d66b05fd30054c15dd628a4e589ffaaa4ba7d0ca689575093b9da9e5
SSDEEP 196608:vBBBBWBBBBWBBBBWBBBBWBBBBWBBBBWBBBBWBBBBOHh6ImzD+Fu:sT
TLSH
T13A478D10B7D28035F5B319318ABFD33A5539B9214F2586CFE3884A3E9D72AE1A931717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 9b4adb74a34a6022966ef2f65e539fe6861a06da66cca429867d74fab965c07c
MD5 e259967afdc286d0ce2ba1f571f4b52c
SHA1 c585c3aa4b4b784e07b421e8e2ca8d28c08eb573
SHA512 eec1aaf4a3ecd3e02b48e18be8855ccd436add48520b13a1db04ec1c2144e673ae85d87efb0602c1614f25f61210fe51330ad0413184314f0e2cdd76be3f20d0
TLSH
T1A411C84254F9E853F832E4C75319ABF64CDC35AB7C986E8523494118BF89C71CD594E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1364-27-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/1364-37-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/2296-8-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/2296-0-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/4448-87-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/4820-59-0x00000000053E0000-0x00000000053E1000-memory.dmp

Download