7a7bcc12db15e62f54d4a145aef22b869da6ba5fd77a4326cd3ba5ac36b07c14

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_e2afdc531f4a979319947c3d4fb50691_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 10.0MB
Sample260813-dk447aywez
SHA256 7a7bcc12db15e62f54d4a145aef22b869da6ba5fd77a4326cd3ba5ac36b07c14
MD5 e2afdc531f4a979319947c3d4fb50691
SHA1 9f256e5b12cf535d3004d9a8bff6bbef30f338ad
SHA512 479784509367d0c052ccae84064930ac397b685dfe5906a79cdb8cb0aa128ade3ef7d596aab6775c04f7251c12aae3f0f501f99f431f7967e40faa741a29d5e6
SSDEEP 98304:r5s5s5s5s5s5s5s5s54/fh6ImzzJoDfuBcMv+A73XAA:r5s5s5s5s5s5s5s5s54Hh6ImzD+FA
TLSH
T14EB65C14FBD711B1FA6356B048EBD3BF5E307A108731CBEFD604DA1AA926AD09439316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3440	svchost_AAAACCCCBBAACCAACBCBCACABABAACCCCBAACCACCABACBACCAACACC.exe
4224	svchost_BCCBCCBBABCACABBCAABCACCAACABACCBCABCACCCBCCBBBAAABCACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCACAACACCAAAACCAABBBACBBAAAACAABAAAACCCBAAAACCCCBCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAACCCCBBAACCAACBCBCACABABAACCCCBAACCACCABACBACCAACACC.exe"	2026-08-13_e2afdc531f4a979319947c3d4fb50691_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCABBCBACCABAABBBABBCABABCCBCACCACCBCBABAACBBBCAACBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBCCBBABCACABBCAABCACCAACABACCBCABCACCCBCCBBBAAABCACA.exe"	svchost_AAAACCCCBBAACCAACBCBCACABABAACCCCBAACCACCABACBACCAACACC.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4444	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBCCBBABCACABBCAABCACCAACABACCBCABCACCCBCCBBBAAABCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_e2afdc531f4a979319947c3d4fb50691_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAACCCCBBAACCAACBCBCACABABAACCCCBAACCACCABACBACCAACACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6120	2026-08-13_e2afdc531f4a979319947c3d4fb50691_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
6120	2026-08-13_e2afdc531f4a979319947c3d4fb50691_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
6120	2026-08-13_e2afdc531f4a979319947c3d4fb50691_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
6120	2026-08-13_e2afdc531f4a979319947c3d4fb50691_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3440	svchost_AAAACCCCBBAACCAACBCBCACABABAACCCCBAACCACCABACBACCAACACC.exe
3440	svchost_AAAACCCCBBAACCAACBCBCACABABAACCCCBAACCACCABACBACCAACACC.exe
3440	svchost_AAAACCCCBBAACCAACBCBCACABABAACCCCBAACCACCABACBACCAACACC.exe
3440	svchost_AAAACCCCBBAACCAACBCBCACABABAACCCCBAACCACCABACBACCAACACC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6120	2026-08-13_e2afdc531f4a979319947c3d4fb50691_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	3440	svchost_AAAACCCCBBAACCAACBCBCACABABAACCCCBAACCACCABACBACCAACACC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6120 wrote to memory of 4444	6120	2026-08-13_e2afdc531f4a979319947c3d4fb50691_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	92
PID 4444 wrote to memory of 5692	4444	cmd.exe	94
PID 3440 wrote to memory of 1824	3440	svchost_AAAACCCCBBAACCAACBCBCACABABAACCCCBAACCACCABACBACCAACACC.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-13_e2afdc531f4a979319947c3d4fb50691_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_e2afdc531f4a979319947c3d4fb50691_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACABCAACACBBACAAABBCCBACBBCBCABCCABBACCBABCBABCCBBAAAABACABACCAACABBCABABCAABBBACACCABABCBCAABBBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCCBBAACCAACBCBCACABABAACCCCBAACCACCABACBACCAACACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACABCAACACBBACAAABBCCBACBBCBCABCCABBACCBABCBABCCBBAAAABACABACCAACABBCABABCAABBBACACCABABCBCAABBBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCCBBAACCAACBCBCACABABAACCCCBAACCACCABACBACCAACACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCCBBAACCAACBCBCACABABAACCCCBAACCACCABACBACCAACACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCCBBAACCAACBCBCACABABAACCCCBAACCACCABACBACCAACACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1824

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCBBABCACABBCAABCACCAACABACCBCABCACCCBCCBBBAAABCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCBBABCACABBCAABCACCAACABACCBCABCACCCBCCBBBAAABCACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5ef7de1e2a32a667f5ed85f3afaa17a7ed8dea56a37137cd98438be834a06a08
MD5 5e69b8868f31897765e924fb31823240
SHA1 eeddce2ea0e7370a856d011f2c2604070ed836a3
SHA512 c1d0e8c0c51396f08a58b3ba2ddbeae03c5d6d0896fc1cb19f3a56f6889459bf187df1f476ab272a79e913e808f8a4a7b83ed320bc2dbc61eb7704ebca0a817b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4875043b1ae90aa71a32fd2cd87f99041afe4090dd3f886b3b4e472ae1c9fac2
MD5 d0be8ee82e083689ea18360670d93d46
SHA1 b36fb9340f9cdffb396509dac505346b540a949f
SHA512 c1fafb0848f4d2561ee81d2aaacf79730dd9dd7d017ec7dd2027d89f5684eee2376dbc2d96d620467b7281efa601ba3d695069b0a7f45e838d08aec6b42f4129
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5ed4e8b3283fe58d2078689633d2d0785ac61f329bc48d345949ff3a5355a90f
MD5 2b203f7ec8fdfc5dff311e0b106a4cbe
SHA1 bb2dca646b80c129ca0e1675380209be1e1708d2
SHA512 4b5cec070fd9c786a2c018f8e2ac2c76f58b39e1370e20b6242768112d6b18145f8ab2da00311a83a1d51fec8f69ec801268bef3d3f6f9c08a581fc66a09494d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a75c0f075ead694e9f78c68c255a613d2cb765873bfd5fb5472d47af0333744e
MD5 da5a2b492d9826905afce5bcbeacf1bb
SHA1 8e01495edd6497c0f43c73f80a453222408d990d
SHA512 c6d94222ade22fcfab170645cd551cbff37ab4679e6a402d74e2b6661e46ba9ad2e1f437662fdc2f745ce132f02826cf8fe5f4e4e0e033c44c1477dfef7ff458
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cb9800c55018c876e9bdbe7f9a7a108104f5924591242ae188f4dfac6b116a48
MD5 9695320c6f57bf4d3b7ae3e654d82be2
SHA1 bed707515b4b798c7e084f588b4f424c52c66d3b
SHA512 141192056f59594237468b825d6f238f5838264c369b337d8dec4dea1b4f5d84ad4c4e8c1a52ed427f42ed3b8aebd55fab43aac2d98038c786adf3533baed0fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e7adc5764d86b0793ebfd64d55947e2b7da0fd6595496cad194abdb881d23229
MD5 dc456b52e1cb260fe1737be896831807
SHA1 404f2549cde35f99a773f9225bc7aefc4115c5b1
SHA512 a10b75d8b5d6a3a2efda94f30647f678bc3e4801c768e4d3d4e063f087b2bbd94cc6065ea61df5a62422f85d026a70f585ae95d198442fa433ba814e2d66eac7
MD5 SHA1 SHA512

Submit Download

svchost_AAAACCCCBBAACCAACBCBCACABABAACCCCBAACCACCABACBACCAACACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCCBBAACCAACBCBCACABABAACCCCBAACCACCABACBACCAACACC.exe
Size 10.0MB
SHA256 7a7bcc12db15e62f54d4a145aef22b869da6ba5fd77a4326cd3ba5ac36b07c14
MD5 e2afdc531f4a979319947c3d4fb50691
SHA1 9f256e5b12cf535d3004d9a8bff6bbef30f338ad
SHA512 479784509367d0c052ccae84064930ac397b685dfe5906a79cdb8cb0aa128ade3ef7d596aab6775c04f7251c12aae3f0f501f99f431f7967e40faa741a29d5e6
SSDEEP 98304:r5s5s5s5s5s5s5s5s54/fh6ImzzJoDfuBcMv+A73XAA:r5s5s5s5s5s5s5s5s54Hh6ImzD+FA
TLSH
T14EB65C14FBD711B1FA6356B048EBD3BF5E307A108731CBEFD604DA1AA926AD09439316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3440-35-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/4224-65-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/6120-0-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/6120-8-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download