57b5a7ab6fb876aee6f2994c6956320ba766ac707f5c34ad0051aa48bd7f6e01

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_899fb6e53d78fd5309ccd657d7520a2d_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
Size 50.1MB
Sample260811-da4exaem7w
SHA256 57b5a7ab6fb876aee6f2994c6956320ba766ac707f5c34ad0051aa48bd7f6e01
MD5 899fb6e53d78fd5309ccd657d7520a2d
SHA1 ffeb6926b55e677b113c9899757728d5423012ad
SHA512 15f16c2842cb7fedfa485b8103867ffd42872b4249f39c5cd2ceeb7b298eb8ab20c1d1b38a890a9610bcb2b9e55a26c65498920a50719a0046e21f8f61c09ae0
SSDEEP 393216:i33333333sLmHN6+JrvI33333333sLmHN6+JrvWo:i33333333s6brg33333333s6breo
TLSH
T13EB7C045F99750F8EC6EA03048A7D337C6317D278131878BA6EDFA466F33A615C1A623
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3892	svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe
3140	svchost_ACBBABCCAAABCBBAACCACCABABACBCBACACBBABCABABBCAAAAAABBB.exe
812	svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABABBBBBBABACBACBBBAABCCCAABCBBBBCBCAABBAAAAABCAACACCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBABCCAAABCBBAACCACCABABACBCBACACBBABCABABBCAAAAAABBB.exe"	svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBCBCACABBCCABBAABBBCCABCABACBBACBCCBBCCABBCAACCCCAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe"	2026-08-11_899fb6e53d78fd5309ccd657d7520a2d_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3828	sc.exe
1560	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1820	cmd.exe
2148	cmd.exe
4788	cmd.exe
2588	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_899fb6e53d78fd5309ccd657d7520a2d_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBABCCAAABCBBAACCACCABABACBCBACACBBABCABABBCAAAAAABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5508	schtasks.exe
2468	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1952	2026-08-11_899fb6e53d78fd5309ccd657d7520a2d_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
1952	2026-08-11_899fb6e53d78fd5309ccd657d7520a2d_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
1952	2026-08-11_899fb6e53d78fd5309ccd657d7520a2d_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
1952	2026-08-11_899fb6e53d78fd5309ccd657d7520a2d_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
3892	svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe
3892	svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe
3892	svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe
3892	svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe
3140	svchost_ACBBABCCAAABCBBAACCACCABABACBCBACACBBABCABABBCAAAAAABBB.exe
3140	svchost_ACBBABCCAAABCBBAACCACCABABACBCBACACBBABCABABBCAAAAAABBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1952	2026-08-11_899fb6e53d78fd5309ccd657d7520a2d_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
Token: SeDebugPrivilege	3892	svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe
Token: SeDebugPrivilege	3140	svchost_ACBBABCCAAABCBBAACCACCABABACBCBACACBBABCABABBCAAAAAABBB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2588	1952	2026-08-11_899fb6e53d78fd5309ccd657d7520a2d_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe	92
PID 2588 wrote to memory of 5508	2588	cmd.exe	94
PID 3892 wrote to memory of 2188	3892	svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe	95
PID 1952 wrote to memory of 1820	1952	2026-08-11_899fb6e53d78fd5309ccd657d7520a2d_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe	98
PID 1820 wrote to memory of 3828	1820	cmd.exe	100
PID 1952 wrote to memory of 2148	1952	2026-08-11_899fb6e53d78fd5309ccd657d7520a2d_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe	101
PID 2148 wrote to memory of 1560	2148	cmd.exe	103
PID 3892 wrote to memory of 4788	3892	svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe	105
PID 4788 wrote to memory of 2468	4788	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-11_899fb6e53d78fd5309ccd657d7520a2d_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_899fb6e53d78fd5309ccd657d7520a2d_cobalt-strike_coinminer_cryptbot_elex_glassworm_hijacklo.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBACCCAABCBACACBABABCCCCBBBBABABCBBBABABCAACABABCCAACACBBBCBBBACCCCCABCBCCCACBBACBBCBCBABBCCCCCAABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBACCCAABCBACACBABABCCCCBBBBABABCBBBABABCAACABABCCAACACBBBCBBBACCCCCABCBCCCACBBACBBCBCBABBCCCCCAABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACAAABBAACCCCABAACCCBBABABBCABBAACACBCACBABAACABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe" start= auto displayName= "UserDataSvc_BCACAAABBAACCCCABAACCCBBABABBCABBAACACBCACBABAACABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACAAABBAACCCCABAACCCBBABABBCABBAACACBCACBABAACABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe" start= auto displayName= "UserDataSvc_BCACAAABBAACCCCABAACCCBBABABBCABBAACACBCACBABAACABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACAAABBAACCCCABAACCCBBABABBCABBAACACBCACBABAACABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACAAABBAACCCCABAACCCBBABABBCABBAACACBCACBABAACABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABCAACCACCBBBABACCACBBBBCACBCBBCBCACCBCCAABCAAACCCBAACBCBBCBABACBACCCBCAACABBBBABABACBBACBBCCCBACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCCAAABCBBAACCACCABABACBCBACACBBABCABABBCAAAAAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABCAACCACCBBBABACCACBBBBCACBCBBCBCACCBCCAABCAAACCCBAACBCBBCBABACBACCCBCAACABBBBABABACBBACBBCCCBACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCCAAABCBBAACCACCABABACBCBACACBBABCABABBCAAAAAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2468

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCCAAABCBBAACCACCABABACBCBACACBBABCABABBCAAAAAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCCAAABCBBAACCACCABABACBCBACACBBABCABABBCAAAAAABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACCABCBACBABCCABBACBCBCCABCAACACAACACBCACACCBABBAC.exe
1⤵
- Executes dropped EXE
PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 959d47eb1c0a55801c780291e7ccb4acd31daa3522e611e77699b207d5419236
MD5 769cce19ba0796fbf3d67843c8d3a304
SHA1 b02746d5792476b0e67d75e96537ae8ec357a10a
SHA512 b84ca2248097f7019b905e8d344d34983736090505f42aa451116ec19d27a80f67270cfea47747ee8a743dcb9857cac200b777b37449f09d6bc8154cb7621916
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cb9ba70af2969eb31c281d1e610c656d3191eb086a6e32eabb2237bf59528f63
MD5 e14951ab33b4557b050d9e2c98eca247
SHA1 c327cde14bf0c90a41ab256dfc1270cc1ead48d6
SHA512 ced78f1034a5f60ba7c7c46cb6bd2073a20ab659a33f8686fd1ca8470a416d006b3a5233ad7b17955e606842b2b420ef101295f262527973dd0a89a12d1cfaf6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 af4b1312258c86d0b72c59962c03987ca7c81eaa59df436c142fcf75cc52558a
MD5 b4d2837a2dda9b9cdc3508d651fe47ce
SHA1 129d709d38aec1f472a2de45ca41fe8e8ca7cbc6
SHA512 1a03500a1b55b63b661f6432d58ad307de923021c47081fdba3ccb97baeac91e1d701e890a29def60ef4f5bf839486f6d64d62e614e08c9f30282813994d3f2d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b90ea19c04fdf5d725381d6839e4fc7e01e78c14c593c1d064d99b564e75f408
MD5 d6afa74b8a355ddcf355bf3620f17b15
SHA1 9faceb4790a4bbe69968c7c8d06c4678e8ef02cd
SHA512 c1ac333959990ae9673ad36f0b8f692c11f27ce0e09f322f54dfb4c8756518d9b5df2aeb4f918271bdbcab744ce117640029cd2542a42c83ee7ca0af5965ade7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 39bc5b936c48411b3a793ec9152723b8609c8b587e79a63a26d5730bd054624d
MD5 981df3c77a8a9dde2d4a67fcf839abee
SHA1 c3ca7fa3bf38ae22be47de6c954eba94bdc1721a
SHA512 c972930f36f3139947e747c090ec3a5fc7f87a42aff77fe61198d9a54c53498f9a19c7d2d63cc1b599c0f1f3478b050015965e7075a539bdc2d35b8f0bf0ebb7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f59a05fbb70d89c20580b5771eaa056959cff77ed3260bdd36779e63469e8da2
MD5 21065bde8f4cc77d9934530ed11f192c
SHA1 ef3d9a3f44b824b186a39c64fdaeb07d62580b5f
SHA512 2fb05b155e86b6742756681e43d791c0977c5de0614ba4f4d6499eddaf7a6a035d84daa7202a0e23d37bda631eb78202264115849b02a0c5246bcbd34cc1e7f6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a9ac63dc95e7db132fdb5a4986b35148b27519fa87ebf6593a410baa5f9a7cba
MD5 f4649a956b3c61063a306a851a5bcba0
SHA1 3dd09ed5b7db6d01321ae6320f128b975440b02a
SHA512 22eb2ae378296701452ea2c659c794c685a783d00d3c44f1b56984906e7f4b89e8912b4cb37d81c9c23c7a063a5f7ee00b6f9ecf49cfa286b28058fc000f7a4a
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 9a9ab78d26165e5205175654528ffaa68cf5fe68af9c477aed2af0b4b64a1d88
MD5 1c7383c5c78484e3a5d9260073d91a34
SHA1 a7bba3ac4865a71aa842acdc6b14f2c2654b4fd0
SHA512 122a67bec61f107863491cb2d0df7a792a83cdd7b94455894a9ac862e6cffb09935923184272ae85790ec74069defb0c85173ef2c6e4ad17254f3ca8a79d39cb
TLSH
T14D110122E8F5C85BEC32688B913DEFD30CA4329F982C6B04135A521C7B99C30CD294A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 03edb6b91f569ce4473e843fa06b374693fe6bd0d7d5c313238b6cebf0d09364
MD5 0ee41b9f68e814a32cce94f54d8017f6
SHA1 8daf32ca11e1006d94af3e9a3f1a91dbb69357eb
SHA512 8d2a0ad748eef5baaeb0795e7f3d8d8e617ecb2b85d38bdcac5b5c76ae06f0ef775d438fbbaa9d86fec84039b08e00f04bcef4e578af9a4654eacfab15dbb2ee
TLSH
T10111C622E4F5CC67AD32A8CBD53DEAE30CA4329F9C6C6A04175E921C7799C31CD194E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/812-73-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/1952-6-0x00000000005A0000-0x00000000005C1000-memory.dmp

Download

memory/3140-63-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/3140-87-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/3892-32-0x0000000000010000-0x0000000000031000-memory.dmp

Download