f638335d1595d3c0d961f8de8a5c05d9da0d988c732aefe28990bb479809de96

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_0c2c2dda023f44fb710c1d01a1955962_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 13.5MB
Sample260812-akbabsfm8x
SHA256 f638335d1595d3c0d961f8de8a5c05d9da0d988c732aefe28990bb479809de96
MD5 0c2c2dda023f44fb710c1d01a1955962
SHA1 3edca94ba09085ece528af16c9210164e02f35ea
SHA512 defcc15607a0938e33c890fc0df9ef72ca4807a9a75b0ffd62a545343cfd603c1d752bce9b64f405ac78f737e8dd3556779765aef1b7a75a2d8ed32846b21a18
SSDEEP 49152:U+ES+EhXp6sXpH+ES+EhXp6sXpH+ES+EhXp6sXpH+ES+EhXp6sXpH+ES+EhXp6s4:e/fh6ImzzJoDfuBcMv+A73XA1
TLSH
T19EE67C02FAC644B1E963027109AB927F5236BC215B31CADBD794766EEE32FC15D31362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
436	svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe
2932	svchost_ABCAACCCABBCCCBAAACABCBCBCAABABCCCBACABCAACCABCBCBACCCB.exe
1560	svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACCCACABACBACAACCACCBCBBBABCBCAABBCCCABAABABACCCBCACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe"	2026-08-11_0c2c2dda023f44fb710c1d01a1955962_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAACCCCCBABBCBBAACCBABABACCAACBAACABCABCABACCBAAAABBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCAACCCABBCCCBAAACABCBCBCAABABCCCBACABCAACCABCBCBACCCB.exe"	svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3760	sc.exe
1848	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2364	cmd.exe
1188	cmd.exe
1564	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_0c2c2dda023f44fb710c1d01a1955962_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCAACCCABBCCCBAAACABCBCBCAABABCCCBACABCAACCABCBCBACCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5168	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1488	2026-08-11_0c2c2dda023f44fb710c1d01a1955962_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
1488	2026-08-11_0c2c2dda023f44fb710c1d01a1955962_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
1488	2026-08-11_0c2c2dda023f44fb710c1d01a1955962_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
1488	2026-08-11_0c2c2dda023f44fb710c1d01a1955962_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
436	svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe
436	svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe
436	svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe
436	svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe
2932	svchost_ABCAACCCABBCCCBAAACABCBCBCAABABCCCBACABCAACCABCBCBACCCB.exe
2932	svchost_ABCAACCCABBCCCBAAACABCBCBCAABABCCCBACABCAACCABCBCBACCCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	2026-08-11_0c2c2dda023f44fb710c1d01a1955962_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	436	svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe
Token: SeDebugPrivilege	2932	svchost_ABCAACCCABBCCCBAAACABCBCBCAABABCCCBACABCAACCABCBCBACCCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2364	1488	2026-08-11_0c2c2dda023f44fb710c1d01a1955962_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	92
PID 2364 wrote to memory of 5168	2364	cmd.exe	94
PID 436 wrote to memory of 3788	436	svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe	95
PID 1488 wrote to memory of 1188	1488	2026-08-11_0c2c2dda023f44fb710c1d01a1955962_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	98
PID 1188 wrote to memory of 3760	1188	cmd.exe	100
PID 1488 wrote to memory of 1564	1488	2026-08-11_0c2c2dda023f44fb710c1d01a1955962_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	101
PID 1564 wrote to memory of 1848	1564	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-11_0c2c2dda023f44fb710c1d01a1955962_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_0c2c2dda023f44fb710c1d01a1955962_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABACCCABBBACCBBBACBBCACCCCBCCCCBAAAABCABBCABABCCBBBBBCAABBBBCBAABBAACCBCCABABCCBBACACABBAABCABCACAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABACCCABBBACCBBBACBBCACCCCBCCCCBAAAABCABBCABABCCBBBBBCAABBBBCBAABBAACCBCCABABCCBBACACABBAABCABCACAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBBBCBBAACBCAABCBCCCBACCBCACBABCCBABACABCBCBBABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe" start= auto displayName= "UserDataSvc_BABBBBCBBAACBCAABCBCCCBACCBCACBABCCBABACABCBCBBABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABBBBCBBAACBCAABCBCCCBACCBCACBABCCBABACABCBCBBABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe" start= auto displayName= "UserDataSvc_BABBBBCBBAACBCAABCBCCCBACCBCACBABCCBABACABCBCBBABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABBBBCBBAACBCAABCBCCCBACCBCACBABCCBABACABCBCBBABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABBBBCBBAACBCAABCBCCCBACCBCACBABCCBABACABCBCBBABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1848

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACCCABBCCCBAAACABCBCBCAABABCCCBACABCAACCABCBCBACCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAACCCABBCCCBAAACABCBCBCAABABCCCBACABCAACCABCBCBACCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe
1⤵
- Executes dropped EXE
PID:1560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3f8ccb2ab232902a1416546588dbe344554b2177448e8799a036b455e4f55a59
MD5 1c6cdbe2ee6c1b377ae36888874ca75f
SHA1 6b95b1d32a4bc9a1fbaf1853c535479f8d25166e
SHA512 5a4a5512852062efdb03ba4a0ee16b6171262b157885861889872fe2abc65df29ef8804762b5cf166541bb794175c60bf3f6c1cc0a45a71bfe6dea3c39e00589
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 47e1b8a6ae810171398aeff056ba64ffa3022aec48489b7915cbeebdc7ac6b65
MD5 97aafac01784415693040326a3ecdc65
SHA1 c588514753a1bb7d21f2f6b5f64e6104fca62f0e
SHA512 b101fc4d60247b512d6eacbfe4c824551212e67385001f8e7d24ecf050adaf432509099656685064eeb47f0fa180dfa0fb877b8a38e39fc8f172db93e7369883
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5fa39e7f3abeb1390c8feef0f2eb9641f13aa7b5e475cb4ea084d0de48a4b740
MD5 8db861bc0c0053d69049117a6cc3014b
SHA1 5dbab23845907a7b83ff06e9111c8c5092fe9aa8
SHA512 7cde3514bf0cf9327aa798e42226d2cfa2e6e289468d6e077fa662584bfe408ceb60cd71526a0f80892dda739ea6200f00d7d17e644332a1c040da189df3b52d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f1ec381d59b593d1f9c9416e89506f9844ab5b022bbde90fa9c91e9ad04e6e3f
MD5 33f2ef6de57df3b4f43680d270395791
SHA1 1ca14ec67087c46e365ab6bae110e10c627d3f96
SHA512 483083af9eebdfb121ae8db5ab6e407498e12845917c981e3ce1b7fd47dd97f70798c93a71c0c6720a08bf89ca0683cc727121356ca58e5045c4e915c1181998
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 236df5bb0171aae1875c3e3ae8ae3aa7e137a09bc651e8d63f1d5b2462d3e888
MD5 aebbaad1d01036e19944509c8f221a3a
SHA1 79dda6614a26557a2c0d7deef29465b0996fab7c
SHA512 d5e4dce04730fe676bfe68e5a4c23ed1b10ddd56d5df115e55103e1ad54168331294c65e2b89c983c76f2d02a0a324c3f6b28875a0b6afe81a6c412d7e581a79
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d0b5f8c2c18a4f1d1a56f32b512c1102d8165d57062b606ed5bc31b81df37c99
MD5 81f60a9d2da85cf120a6e736bcd92b76
SHA1 f505eac2ded907ff0f5037a99dd6ed7a54f70c2d
SHA512 7b907a7c78ebdbdb16706756fb084880c6afedab8fbadf7755b584f209c586277f9cc60213c40b46014aee36101efc3170d34f572d4293914012f0bd916a1578
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 75da0cd0689f5b08690e8b357bc7613aa3120d974c9c8f76c4a4f100a06723c0
MD5 60000226fa709aa940f9d73bf15bf95a
SHA1 3a2e9cd3bb8689de64a337dc49a35a433b363bbb
SHA512 d561762c0c279c6df5e60758884aad767fb5363c31780b3b6ae8513e0c38c4d495f7b9a2f49ab8d6551b5717677e3775c6381d7d769edecb0d72fb0c3ce42812
MD5 SHA1 SHA512

Submit Download

svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCCBACBCAACAACBAABBCAACBCBACABAAAACBAAABAABBBACB.exe
Size 13.5MB
SHA256 f638335d1595d3c0d961f8de8a5c05d9da0d988c732aefe28990bb479809de96
MD5 0c2c2dda023f44fb710c1d01a1955962
SHA1 3edca94ba09085ece528af16c9210164e02f35ea
SHA512 defcc15607a0938e33c890fc0df9ef72ca4807a9a75b0ffd62a545343cfd603c1d752bce9b64f405ac78f737e8dd3556779765aef1b7a75a2d8ed32846b21a18
SSDEEP 49152:U+ES+EhXp6sXpH+ES+EhXp6sXpH+ES+EhXp6sXpH+ES+EhXp6sXpH+ES+EhXp6s4:e/fh6ImzzJoDfuBcMv+A73XA1
TLSH
T19EE67C02FAC644B1E963027109AB927F5236BC215B31CADBD794766EEE32FC15D31362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1ea02cc6ba0b008077ab4f5f5e612925a7f05224b65d6138d61495259ea3705b
MD5 51a0a6d2328ff3ef85e8cba1eee502eb
SHA1 60f564538a2896c6d8de4bd02cbf2d0cf49577dd
SHA512 3305b8085d8c9a70959a190b88d87863a37cea7cf18ea37b01854cac7f7e54269febcc5e72654e647f4812f77acb832e562905ab6c69c4f180b52cd928b3bad4
TLSH
T19C11CB7094EAD827F92278DF6139EBD70DE0369F9C386E54134C42187B95C318E214F6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/436-33-0x0000000000070000-0x0000000000091000-memory.dmp

Download

memory/1488-7-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/1488-0-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/1560-84-0x0000000000070000-0x0000000000091000-memory.dmp

Download

memory/2932-64-0x00000000006E0000-0x0000000000701000-memory.dmp

Download

memory/2932-82-0x00000000006E0000-0x0000000000701000-memory.dmp

Download