40dd3bbaf9a8a896f6e8bde19db96a79f08d11bd440807941bf7a5afeec95dc0

Analysis

max time kernel
151s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_6c6774dfdea423fb9d231d86467ed88a_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
Size 59.3MB
Sample260811-bmtecsdl8t
SHA256 40dd3bbaf9a8a896f6e8bde19db96a79f08d11bd440807941bf7a5afeec95dc0
MD5 6c6774dfdea423fb9d231d86467ed88a
SHA1 a0cdc4feeb8f2a53866a05d764e3a58369f23625
SHA512 393162914acde4281050a18460b25adc614db4ee8fa38e7980ce209a57971ed4c25a3f5eb960130854568165d3908c2e736d996ad5c69b513454ff219d480545
SSDEEP 98304:6p7kp7kp7n/fh6ImzzJoDfuBcMv+A73XAi:4qqnHh6ImzD+Fi
TLSH
T17BD75B09F94340B1D92B11B04DCBD2BF8A30BA2587228EE7FA4DDB1B7933BE16435655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3296	svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe
2980	svchost_ACBBBCBBBBACCCCCABCABCCCAABCBAAABBBBBAAAAACCBCBBBAACAAC.exe
2424	svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBAABABBCBBCCBAABBAACBCACAACAAAAACCBBBCAAAACCACCBBABBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe"	2026-08-10_6c6774dfdea423fb9d231d86467ed88a_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCABABBCACBCBCCCCAABBCCCCBABBAABACCCAABCBCABBBACAACBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBBCBBBBACCCCCABCABCCCAABCBAAABBBBBAAAAACCBCBBBAACAAC.exe"	svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4372	sc.exe
2920	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1076	cmd.exe
3464	cmd.exe
2664	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBBCBBBBACCCCCABCABCCCAABCBAAABBBBBAAAAACCBCBBBAACAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_6c6774dfdea423fb9d231d86467ed88a_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5176	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4288	2026-08-10_6c6774dfdea423fb9d231d86467ed88a_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
4288	2026-08-10_6c6774dfdea423fb9d231d86467ed88a_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
4288	2026-08-10_6c6774dfdea423fb9d231d86467ed88a_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
4288	2026-08-10_6c6774dfdea423fb9d231d86467ed88a_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
3296	svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe
3296	svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe
3296	svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe
3296	svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe
2980	svchost_ACBBBCBBBBACCCCCABCABCCCAABCBAAABBBBBAAAAACCBCBBBAACAAC.exe
2980	svchost_ACBBBCBBBBACCCCCABCABCCCAABCBAAABBBBBAAAAACCBCBBBAACAAC.exe
2424	svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe
2424	svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4288	2026-08-10_6c6774dfdea423fb9d231d86467ed88a_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
Token: SeDebugPrivilege	3296	svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe
Token: SeDebugPrivilege	2980	svchost_ACBBBCBBBBACCCCCABCABCCCAABCBAAABBBBBAAAAACCBCBBBAACAAC.exe
Token: SeDebugPrivilege	2424	svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 3464	4288	2026-08-10_6c6774dfdea423fb9d231d86467ed88a_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe	92
PID 3464 wrote to memory of 5176	3464	cmd.exe	94
PID 3296 wrote to memory of 2148	3296	svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe	95
PID 4288 wrote to memory of 2664	4288	2026-08-10_6c6774dfdea423fb9d231d86467ed88a_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe	98
PID 2664 wrote to memory of 4372	2664	cmd.exe	100
PID 4288 wrote to memory of 1076	4288	2026-08-10_6c6774dfdea423fb9d231d86467ed88a_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe	101
PID 1076 wrote to memory of 2920	1076	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_6c6774dfdea423fb9d231d86467ed88a_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_6c6774dfdea423fb9d231d86467ed88a_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBABBACBCCACBACCCCCBBBCCCBCBCCABBBCCACCBACBBACBBACBBCCBAABBBBAAAAAAACBACBACCCCABACBCBABACAAAACACBAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBABBACBCCACBACCCCCBBBCCCBCBCCABBBCCACCBACBBACBBACBBCCBAABBBBAAAAAAACBACBACCCCABACBCBABACAAAACACBAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACACBAAAABCCCABCCBBBAACBCACBAACACAAABACACABBBAAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe" start= auto displayName= "UserDataSvc_BACACBAAAABCCCABCCBBBAACBCACBAACACAAABACACABBBAAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACACBAAAABCCCABCCBBBAACBCACBAACACAAABACACABBBAAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe" start= auto displayName= "UserDataSvc_BACACBAAAABCCCABCCBBBAACBCACBAACACAAABACACABBBAAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACACBAAAABCCCABCCBBBAACBCACBAACACAAABACACABBBAAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACACBAAAABCCCABCCBBBAACBCACBAACACAAABACACABBBAAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBBBBACCCCCABCABCCCAABCBAAABBBBBAAAAACCBCBBBAACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBBBBACCCCCABCABCCCAABCBAAABBBBBAAAAACCBCBBBAACAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBBCAAABCBCCACCCACBAABCBCBAABCCCCCABBCAAAAABBBAACA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 fad4601e3dd28cb8a47328be1246ec1d8ee971aa778bb199ae2752eac729a78b
MD5 224df8c8baeb3e3afdb14e967ee4d24f
SHA1 36012d478115f8add9bd03452a0982aa8136f8ee
SHA512 f412a78cf1614a18160148da8e323e288e97ef34cc680410c6ddb0b5b69b73569892c1a246996258b99b64b31aa086bb3f512a598c070795a7ad9bcb40c98f57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8a8c26f77b83073c7da750a1fd0f6aef701c1b6c95ddd2862dc5252f0feff10f
MD5 54931de8753f1694c70bf5b8989f2046
SHA1 fa72ef316345e058b02eae2347c739323a79186a
SHA512 ca57f7f34104d16c20fbeedfb868af0de96b0e8d1450d7cf03eef78b577cb46768f1376de11bc6bc25f640b68fa1e5a09c382580b4665ab1e0482248b31d4d1e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fc2e51f6be45d574d3713ade2b99dceed49524b16abcb5d6e0d4539243bf301c
MD5 f1d9fbe01b5aab67bcbfb1139fff85f0
SHA1 4ca941962573eebd2b17b9f4f92b2e738afd6af1
SHA512 4c5470a650d0bd5ddf070d489464e54e2eec87bd2755e69b68f9eef3202ef85afd66cf6fe564bb8cda7428fd427eb89af87cdb8762c39d5a55eacce3596cec75
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 439716171c5744c2b1d3485ae326c0c33bebf7fbcfd28d2393cc40bac33c5c20
MD5 5282bbd7efb88f2736263fcbe716c327
SHA1 77105c3273c9f0f34e74a042ff5affcd12029504
SHA512 e2b76a8cfc29c47d62f846d1fc59dc0ae3f29c8e1800503217f22279bddff617c9caf9d206c3573bf7ab809a8c5781ea9e868599131cca3bde904ea85ccf19d3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 57adea591b5ee32578a20924663803d1130577cb82edb0dad65ffb0a59f199ba
MD5 418dfa343acb068812d784488c290871
SHA1 c509d1584e62294d7ab2ae61c9ca20ef690f97b3
SHA512 d585d8124a9c062991d7699e4b16429ab3d86ac49fa426835f857ae1f2e11772fcb2da4811f72774c155ef2250eeca9b9d2eb149086ebe74c52ed3a1f6d34dff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e9e4f88d21ad89f2baaebc0a0f86054336b708c4253b29c038095762d85e8c14
MD5 4df0e31f35676c5668dfc993ccb9399a
SHA1 786d211d494d0e4cdf3165c431963f90bddcb7e3
SHA512 9540e4c3eed219d71791831aada8c30e54f65ba74b87b0d188b9cd26ef4dd000a88523370eaf6415ff4721f9e651b6335bd19886e9cab49b2fece3b91d60bcec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d0f894271afa9202a1466bccc9b0c973e110de79d08a10edffa7fb47b8dc8164
MD5 5625471536981deb83b7819b718ca693
SHA1 33c61495f0a624c08002409f5a7fd5c7cbe4ca0c
SHA512 157f607a242d88b95cf3e7c8f1cc9f8855065a710b53e3c25d5ae0ce129e238f8de68b04214e332312295c7245dcd1e628043b897c5d6543574fc8bc141c8ba6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f89b10128fa5f27a91fb0b10233787d203668a7d409440de89a9d8785021d95f
MD5 7fa328814e26bc0f8f1f87940074ed15
SHA1 aa35b609a8658749768010e31806ee0a696ea092
SHA512 1f7678724f8aa5ba1e77dd0d120a7cde8584ed277ee377653baaf2bf55579003051f4a4096ca85e221472e8680cdd334e12b4b01db870588c7d0963377bc1c81
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 9f534b62a7ebcee7df792a462f0ec0751af18e1cb446fbc18968f8541c73f379
MD5 ae5fae57a9807db56bd24bb5c974be62
SHA1 8471799937c8681d4087132c815b4e85ae4b4cdb
SHA512 8624df9a7cbb11b7896964e222f42197727aa8c0e675e341393ed6e20459ab9ac657de92b28aa3ba753f86e427a83f6d55a91676e2c656ffbac8e76c7a50467b
TLSH
T1C711C161E4A594A3FD332C9F9639CAC34CAC26CBAC646B142B1851186389C218E2D8E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 77e565fc112a577525a76bd2b0f8e34d85739eaf6a02e1fe79e8b3fa064bea75
MD5 07ffd87fc1f176b4965d00b6957e4aae
SHA1 263b7fe7370acf422a8b2271e357f0097864f945
SHA512 3845b98f26de2d81d86ea8b810827c65c4990fcf33bbb17dc2946348705acdadca1e8151d5b72a69be8560b38f9fde4dbd2bd594f2f96eaf5f3ae7bef06306e6
TLSH
T1C321C661E4A5C8A3FD332C9FD639CAD34CA836CBA8646B142B1C51186789C318F1D8E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2424-84-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/2980-82-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/2980-69-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/3296-33-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/4288-0-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download

memory/4288-7-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download