81bc91a12bc62daef563501aa3723d7aaa6e3316cda6bd19fe239a81bb964360

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_85751e4a155786bb7fc7286532096b45_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
Size 45.9MB
Sample260810-e5yzcabj7x
SHA256 81bc91a12bc62daef563501aa3723d7aaa6e3316cda6bd19fe239a81bb964360
MD5 85751e4a155786bb7fc7286532096b45
SHA1 89f0b8068393e472436aaf31ee05e4b65d3ac2cc
SHA512 50faf3244680c110e92c0a4e0126d4b790e3426366cd57a571f3a91db3632b1b7612e90220c376697b01f59b04594a50ab9e0b7e3ca112bc4820bc03d6f0c793
SSDEEP 393216:iZahvQHrc8u3xXqZahvQHrc8u3xXqZahvQHrc8u3xXqZahvQHrc8u3xXc2:iSvQHrKaSvQHrKaSvQHrKaSvQHrKM2
TLSH
T15AB7AE27F69A00F5C41AD138865B9627EA767C144325ABDF06907B252F33BF01B3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c545-18.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5416	svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe
1748	svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe
3200	svchost_ACABCCBABABCBBABABCCBBAABCAAAACBBCCBCBAABABCCABCACBBABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBACAACCCBABCACCACBCCABBABCBCCBBBBABAABBCBCBBABAABCCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe"	2026-08-10_85751e4a155786bb7fc7286532096b45_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAABBCACBACCACBCAAAACBCCAACCCBBBBCAAACACAABBBAABABACBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABCCBABABCBBABABCCBBAABCAAAACBBCCBCBAABABCCABCACBBABB.exe"	svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
784	sc.exe
2568	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6112	cmd.exe
2700	cmd.exe
3964	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_85751e4a155786bb7fc7286532096b45_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABCCBABABCBBABABCCBBAABCAAAACBBCCBCBAABABCCABCACBBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1116	2026-08-10_85751e4a155786bb7fc7286532096b45_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
1116	2026-08-10_85751e4a155786bb7fc7286532096b45_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
1116	2026-08-10_85751e4a155786bb7fc7286532096b45_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
1116	2026-08-10_85751e4a155786bb7fc7286532096b45_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
5416	svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe
5416	svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe
5416	svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe
5416	svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe
3200	svchost_ACABCCBABABCBBABABCCBBAABCAAAACBBCCBCBAABABCCABCACBBABB.exe
3200	svchost_ACABCCBABABCBBABABCCBBAABCAAAACBBCCBCBAABABCCABCACBBABB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1116	2026-08-10_85751e4a155786bb7fc7286532096b45_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
Token: SeDebugPrivilege	5416	svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe
Token: SeDebugPrivilege	3200	svchost_ACABCCBABABCBBABABCCBBAABCAAAACBBCCBCBAABABCCABCACBBABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 3964	1116	2026-08-10_85751e4a155786bb7fc7286532096b45_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe	92
PID 3964 wrote to memory of 3532	3964	cmd.exe	94
PID 5416 wrote to memory of 4240	5416	svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe	95
PID 1116 wrote to memory of 6112	1116	2026-08-10_85751e4a155786bb7fc7286532096b45_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe	96
PID 6112 wrote to memory of 784	6112	cmd.exe	98
PID 1116 wrote to memory of 2700	1116	2026-08-10_85751e4a155786bb7fc7286532096b45_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe	99
PID 2700 wrote to memory of 2568	2700	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-10_85751e4a155786bb7fc7286532096b45_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_85751e4a155786bb7fc7286532096b45_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCABCAAACCBCABABCACBAACBBCBBBACCBAABAABBCCCAACACCACCACBAACAAAACCBAAAAABBBBBAAABCBACCABAAAAACCABBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCABCAAACCBCABABCACBAACBBCBBBACCBAABAABBCCCAACACCACCACBAACAAAACCBAAAAABBBBBAAABCBACCABAAAAACCABBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAABCBCCCAACBCBABCABBCBCCCBBBBABACCBABBBBCACBACBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe" start= auto displayName= "UserDataSvc_CCAABCBCCCAACBCBABCABBCBCCCBBBBABACCBABBBBCACBACBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6112
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAABCBCCCAACBCBABCABBCBCCCBBBBABACCBABBBBCACBACBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe" start= auto displayName= "UserDataSvc_CCAABCBCCCAACBCBABCABBCBCCCBBBBABACCBABBBBCACBACBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAABCBCCCAACBCBABCABBCBCCCBBBBABACCBABBBBCACBACBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAABCBCCCAACBCBABCABBCBCCCBBBBABACCBABBBBCACBACBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2568

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe
1⤵
- Executes dropped EXE
PID:1748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCBABABCBBABABCCBBAABCAAAACBBCCBCBAABABCCABCACBBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCBABABCBBABABCCBBAABCAAAACBBCCBCBAABABCCABCACBBABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d6efe84d091bbf6261fce7765c4219dc5208423b06143d5db0bacfcd4be3f3ef
MD5 f36dbf7c678d823d93cadcefed8543fd
SHA1 f39362a29ca2616c99298b9c2e0f65947ad7831d
SHA512 f9bedd81e65a8ff244c9b76904e144bbdc5253d0bb6f636022b03a324cd2c0b1d3da0e06317ba08b76d04f60ee8b6e3e0dd20b6d4cc6637091bf14db1185383f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5114d9f849922a98c3ccf104100b7e5fa750223dfca0de1bc1c7208d41b69c12
MD5 2d019fd85f9c6fa1e76781e1c128161a
SHA1 487430d7e14b00793dabd161e8b875404d657fad
SHA512 f4edd3dc84f8231bd8d54ab393f2a1cd19f1ec1aa0d661a4c33930ec0a69f2a341a1842a2b2debd9a52793f79e040d0214be7de0de1bf3bf9ac652b3b09f242f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 092218d4112307498328f382acb6488915bc008e76e8ede98a1725a9409a7b8f
MD5 038b2373cca02440f593e2f4e886490b
SHA1 632272fd1e4a9a9842d733b998093898fe10092d
SHA512 149d0733a6277652ac33cc6d00014f183e9fdd57be0fd306fb57a47e8bc78860ef99dab73692a3b4c4221c71cb43a9b5f2cb565c11515c3c25ff0c81a99ffe00
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 569e051079ff346449bb7c72a3b5c41c8dea81b86ed8c0f5d4d71bf6aec7e536
MD5 f03475d6d29ccea8f36da97dccae7f5e
SHA1 ecaf2702f4744b7b5a6b3ae67c5bdf1a652579f6
SHA512 254c558f7a081e9e0bfae93e72fed990bb8014cc0378fb269c83b2793f01441f334608b8cfad11fe1b4eea395345252d530fa163906359730bafb9f39ce52a72
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 14cf5088f1a3521ff88b5fefd3f08480cdf2200962640657462b1a9e8328edf1
MD5 60f3313008e792154ce510cb409e76ab
SHA1 7e47af9514b4aed8680ac6faa285ebfdd2e1e6d7
SHA512 fe330c1956474176e4abb39664d2a982ee6e0702a198f03f32c56a4c80f701cfa2d11ff5ae0f9d2b2d16e47779895c9b26bd5081fd547a8683376ff3a070b028
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c08158c9fa7ed0a9a78144a6913bdfdea8e2a5c77ccafe18fd132285699a3c2e
MD5 32d6cce8a67ade847af795e7bf3a34b1
SHA1 e0ad59c1901bc02db0a354957175d29a9a0fe48f
SHA512 4b3421c5cb9c9066b942689b52d9bfda0743207b745d71972c18e6449fd8cf0754d2b40ad0a97ecfebba2038aa772cbc9bc2a6bad366b1cb1374e6730a3d3ef7
MD5 SHA1 SHA512

Submit Download

svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCABCCAACACBBABCBAAACBCAAAABACBBCCBCBABCABBBBCAABCCA.exe
Size 45.9MB
SHA256 81bc91a12bc62daef563501aa3723d7aaa6e3316cda6bd19fe239a81bb964360
MD5 85751e4a155786bb7fc7286532096b45
SHA1 89f0b8068393e472436aaf31ee05e4b65d3ac2cc
SHA512 50faf3244680c110e92c0a4e0126d4b790e3426366cd57a571f3a91db3632b1b7612e90220c376697b01f59b04594a50ab9e0b7e3ca112bc4820bc03d6f0c793
SSDEEP 393216:iZahvQHrc8u3xXqZahvQHrc8u3xXqZahvQHrc8u3xXqZahvQHrc8u3xXc2:iSvQHrKaSvQHrKaSvQHrKaSvQHrKM2
TLSH
T15AB7AE27F69A00F5C41AD138865B9627EA767C144325ABDF06907B252F33BF01B3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1819b86cb218415e786e5ff84fad24b8fcd07518fbd081c541162f0161e309f5
MD5 535d1ad7a960096748728bf851d496c3
SHA1 fd37b036d701459b0ffd91b8f59c84a6896b0359
SHA512 5621fc1fd7078098599b7bc863f661fe1af09b610dedaa4ef86c3f57f0b7545863500ff15ac82059b50ce6ffd52fafeb2d73f6073e486f5f50a81b58ec206622
TLSH
T11F11EE61B899D823EF3228CB921FDAF31CE43797AD1C9A14130A411DABD9D31CDE54E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1116-6-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download

memory/1748-66-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/3200-72-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/5416-35-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/5416-22-0x0000000000090000-0x00000000000B1000-memory.dmp

Download