6f77208072a20808a020234b920179314220be6d897a2cb11a6e6e664ad38b92

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_be278d7997865115bf54ba11a5e40a6f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 13.1MB
Sample260813-d8zjls1cmd
SHA256 6f77208072a20808a020234b920179314220be6d897a2cb11a6e6e664ad38b92
MD5 be278d7997865115bf54ba11a5e40a6f
SHA1 63b7f7e5afc46fb6427a4e1904c37fe4588723e2
SHA512 eddf9181cdd73a0527f33d1b06a17093b7210765419544bb0371161fe182e0fae3c50bc9bd16c34d053047574c06c005f91b0b7fb4d259f6f0c0361a076989b1
SSDEEP 49152:U+EPiw25+EJwqp+EPiw25+EJwqp+EPiw25+EJwqp+EPiw25+EJwqp+EPiw25+EJF:o/fh6ImzzJoDfuBcMv+A73XAo
TLSH
T112D67D10B6FE0C71F1B7663159B2962A4D32BA154338D2CFE5944B5EAD23BC05933BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1160	svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe
4760	svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe
4608	svchost_BACBBABBBACCCAACABCABBBBCCBACCACBBBCBBCCABBABCCCBABBBAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBCAACAAABCCCCABCACCACBBACABCBABABBBCBBAAACBAACACCCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe"	2026-08-13_be278d7997865115bf54ba11a5e40a6f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBCBAABABBAACACCCBACBCCCBAAAABACBBCCCBBBACCABBBABBCCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBBABBBACCCAACABCABBBBCCBACCACBBBCBBCCABBABCCCBABBBAA.exe"	svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
612	sc.exe
5772	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2344	cmd.exe
1492	cmd.exe
4616	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_be278d7997865115bf54ba11a5e40a6f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBBABBBACCCAACABCABBBBCCBACCACBBBCBBCCABBABCCCBABBBAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2132	2026-08-13_be278d7997865115bf54ba11a5e40a6f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2132	2026-08-13_be278d7997865115bf54ba11a5e40a6f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2132	2026-08-13_be278d7997865115bf54ba11a5e40a6f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2132	2026-08-13_be278d7997865115bf54ba11a5e40a6f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1160	svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe
1160	svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe
1160	svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe
1160	svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe
4608	svchost_BACBBABBBACCCAACABCABBBBCCBACCACBBBCBBCCABBABCCCBABBBAA.exe
4608	svchost_BACBBABBBACCCAACABCABBBBCCBACCACBBBCBBCCABBABCCCBABBBAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2132	2026-08-13_be278d7997865115bf54ba11a5e40a6f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	1160	svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe
Token: SeDebugPrivilege	4608	svchost_BACBBABBBACCCAACABCABBBBCCBACCACBBBCBBCCABBABCCCBABBBAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2344	2132	2026-08-13_be278d7997865115bf54ba11a5e40a6f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	91
PID 2344 wrote to memory of 2384	2344	cmd.exe	93
PID 2132 wrote to memory of 1492	2132	2026-08-13_be278d7997865115bf54ba11a5e40a6f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	94
PID 1492 wrote to memory of 5772	1492	cmd.exe	96
PID 2132 wrote to memory of 4616	2132	2026-08-13_be278d7997865115bf54ba11a5e40a6f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	97
PID 4616 wrote to memory of 612	4616	cmd.exe	99
PID 1160 wrote to memory of 5032	1160	svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-13_be278d7997865115bf54ba11a5e40a6f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_be278d7997865115bf54ba11a5e40a6f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCBCACCCBCCACBCCAAABBAAACABCCAABAACABAAABBBCAAACBBACBCCAAAABBBACBCCCACACCBACACABACBAAACABBBBACBBBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCBCACCCBCCACBCCAAABBAAACABCCAABAACABAAABBBCAAACBBACBCCAAAABBBACBCCCACACCBACACABACBAAACABBBBACBBBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCACBCCBACACCABCAAABAAABBABCCCBCCBBBABACACAACABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe" start= auto displayName= "UserDataSvc_CCCACBCCBACACCABCAAABAAABBABCCCBCCBBBABACACAACABBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCACBCCBACACCABCAAABAAABBABCCCBCCBBBABACACAACABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe" start= auto displayName= "UserDataSvc_CCCACBCCBACACCABCAAABAAABBABCCCBCCBBBABACACAACABBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCACBCCBACACCABCAAABAAABBABCCCBCCBBBABACACAACABBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCACBCCBACACCABCAAABAAABBABCCCBCCBBBABACACAACABBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe
1⤵
- Executes dropped EXE
PID:4760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABBBACCCAACABCABBBBCCBACCACBBBCBBCCABBABCCCBABBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABBBACCCAACABCABBBBCCBACCACBBBCBBCCABBABCCCBABBBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 08f77df6cbb16f8afa47eb159d92fc7b0a0f1faa5634d63258ee03d936403cc3
MD5 0b9cc59e34520440c6a4d943ae00c0a5
SHA1 fc1bea23016e127bf249cdbbf341c742f214dc7c
SHA512 eeefc981b5f2219c46ed8e4f77b6c7161723bffd8aeb74e978e7e57d15c6741ef176c28ecb87f31a7ca8e5192e0243a0ed9d8bf1a98e766757b625956e44ed5b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5d7aa22ad4f63675d57860ca262183a5db86e814558fcf35e5e2c4cd184b2a01
MD5 7e7d8f8a3aafa4483ba600c44239126b
SHA1 92836cf932dd739d62ed4a4c3684e78a8fb96827
SHA512 fa7d7f947e29ea19c39bc031b910cac638cf9b201a788072e4efe43e20253777a44d9249e716fd56711f41e725d7fd7b809804cab792ab4b332f55f7de71dc92
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 26b5be69bb58ae903fae1a03cf12585aceb2914498d30d7feb1c83961ad810d1
MD5 183e9fef77f5541b562c4a1e34f824c6
SHA1 1bd393b97b3160d10fd683cdab211afe82d9a58c
SHA512 75397404748d09d903990b972410bb26e87cea493e480c908639be5393a82c8687b0ed713c39e96609cc289f82fd8e929ac62c98b1cc4e1171aeb2f093ff6be7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 33a66f90bbd7f06a273a163156e2c26b749e307800f38e64d4e3db3a6b46adbf
MD5 15b38427c98678bce90520bebd577d4f
SHA1 1397dc8bc728731cd19b2d30d4e3e14166a8a462
SHA512 292f8205c0fb6d193a7c95750649d7379ae8dc6722a4b1c8f4f5cd18e83886ba77a448f8ae58789b753c3a082e416c97556d746743e5be892767a76a5ed8491c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 99d5a6fc5b6c46564d62f5281f7334517c559bda4f98961d6a9b576997f41478
MD5 dd6776da0b666b096d47f4726d670f2a
SHA1 c2ccb44a4c877314a8fcd9a3681c3ee87c6faa8c
SHA512 49f8404d856b77c60cd28c30eaf79819e1d58893aad6fb6b98ea4d745dc960d67a3cd6e9275a5445c8f92f946d66f11a32670cb36fd389121dc55aa68df847a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b66a46ddcd87bdbacdc219a9401050dd0d80034df8a307b9aeafcb348f1f45f
MD5 3787ba032d004726d7b82827ead07187
SHA1 928045693d205595765484708e271e0c4f7b82f6
SHA512 084e69b2b3085f7a2ac6f8da26d92f7898a8c87665c5992602b3b66ff9618e6a74418e32af0bca59025adab52c6ba6f92b0d19926d8886021ae1b579c2d3f7e3
MD5 SHA1 SHA512

Submit Download

RequestConvertTo.exe

Path C:\Users\Admin\Downloads\RequestConvertTo.exe
Size 2.9MB
SHA256 78690dee85f3e03ffa6bf7ecdce22f86c3fc2c1b891a851c380fec9d724e55d0
MD5 be6814c0e217950374396f399706f139
SHA1 11fce112dc996beec0e01e82eb242fc9bb0b5cac
SHA512 d8b765ace90b5d3e580d718a2891f6d369a195b433e244a819a3ed51321ae0af1bf4f0c4f6fd7c3289b63c44485a4e0f1ff3ba4adff6f91265df9ab78c1b1fdc
SSDEEP 49152:U+EPiw25+EJwqp+EPiw25+EJwqp+EPiw25+EJwqp:j
TLSH
T1F0D57B1477FC0C12F1FB62355AB186154D72BA668738D2CFA599865E2D33BC09C32BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACABCCBCBAACAAAABBCCCCBAACACCBACBBBAACACBAAABCACCCA.exe
Size 13.1MB
SHA256 6f77208072a20808a020234b920179314220be6d897a2cb11a6e6e664ad38b92
MD5 be278d7997865115bf54ba11a5e40a6f
SHA1 63b7f7e5afc46fb6427a4e1904c37fe4588723e2
SHA512 eddf9181cdd73a0527f33d1b06a17093b7210765419544bb0371161fe182e0fae3c50bc9bd16c34d053047574c06c005f91b0b7fb4d259f6f0c0361a076989b1
SSDEEP 49152:U+EPiw25+EJwqp+EPiw25+EJwqp+EPiw25+EJwqp+EPiw25+EJwqp+EPiw25+EJF:o/fh6ImzzJoDfuBcMv+A73XAo
TLSH
T112D67D10B6FE0C71F1B7663159B2962A4D32BA154338D2CFE5944B5EAD23BC05933BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 252576c7fb3262cddbf3341d1416786bbbd9a6ed26538c94b0bbe408646c53c1
MD5 f158e920df91ea73ff465e9ccddd841e
SHA1 62e6c32b7850188ed02fd077e295a2fe4f83b799
SHA512 20a22fba731a1f02205c4b62a139a95ea59fb1e60cae6d187a436410555f6df166b9b3d56e6d9510742f782cfc23bccb730c0adc316435118e0e108b3b11cba6
TLSH
T1DB113D10E4E5CC53E832648B333FDB820CF83B4B6C5CBA2813498719A7A4D734D158E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1160-71-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/1160-50-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/1160-32-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/1160-110-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/2132-21-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/2132-33-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/2132-59-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/2132-82-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/2132-10-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/4608-95-0x00000000007B0000-0x00000000007D1000-memory.dmp

Download

memory/4760-87-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download