254b410baf08f856bb3c02bf602ca2006ee6b39f9a566c4a4589e1cac81093f7

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_ce06dd0a0909c97d972449ce0bc43b98_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 12.3MB
Sample260813-dxm2fa1bka
SHA256 254b410baf08f856bb3c02bf602ca2006ee6b39f9a566c4a4589e1cac81093f7
MD5 ce06dd0a0909c97d972449ce0bc43b98
SHA1 dcef1f386255df286c6584fe3ad6877934fabbab
SHA512 92aab076acff4161e02e68671c1cbd3ab2dad88a12749a86d8f8ba03d95d8aba3ecd8edbe6e740ffb629c31cbbcfece5c30caf36ac3ca80c7443c0d7a9578236
SSDEEP 49152:U+EPiw25+Ef+EPiw25+EkI+EPiw25+Ef+EPiw25+EkI+EPiw25+Ef+EPiw25+Ek2:5/fh6ImzzJoDfuBcMv+A73XAc
TLSH
T18ED64A05FAEE48B4E9B3623049A7C27F9671B8118732CADFD240872E9E73AD05D35716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5924	svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe
4876	svchost_AAAACBCBAAABCCACCCCACACACABBCBBCACCCBACABCBACCBABCBBBCA.exe
5020	svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBABACCACCCBCBACAAAABACACACABCCBACCBBBBCBABBCCCBACCBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe"	2026-08-13_ce06dd0a0909c97d972449ce0bc43b98_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAAACCCBBCACAAAABACBBACCBBACBCACBABCCACBACCCCAACAACABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAACBCBAAABCCACCCCACACACABBCBBCACCCBACABCBACCBABCBBBCA.exe"	svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1796	sc.exe
696	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5588	cmd.exe
1460	cmd.exe
3632	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAACBCBAAABCCACCCCACACACABBCBBCACCCBACABCBACCBABCBBBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_ce06dd0a0909c97d972449ce0bc43b98_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4284	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2372	2026-08-13_ce06dd0a0909c97d972449ce0bc43b98_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2372	2026-08-13_ce06dd0a0909c97d972449ce0bc43b98_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2372	2026-08-13_ce06dd0a0909c97d972449ce0bc43b98_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2372	2026-08-13_ce06dd0a0909c97d972449ce0bc43b98_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5924	svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe
5924	svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe
5924	svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe
5924	svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe
4876	svchost_AAAACBCBAAABCCACCCCACACACABBCBBCACCCBACABCBACCBABCBBBCA.exe
4876	svchost_AAAACBCBAAABCCACCCCACACACABBCBBCACCCBACABCBACCBABCBBBCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	2026-08-13_ce06dd0a0909c97d972449ce0bc43b98_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	5924	svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe
Token: SeDebugPrivilege	4876	svchost_AAAACBCBAAABCCACCCCACACACABBCBBCACCCBACABCBACCBABCBBBCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 5588	2372	2026-08-13_ce06dd0a0909c97d972449ce0bc43b98_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	92
PID 5588 wrote to memory of 4284	5588	cmd.exe	94
PID 5924 wrote to memory of 2136	5924	svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe	95
PID 2372 wrote to memory of 1460	2372	2026-08-13_ce06dd0a0909c97d972449ce0bc43b98_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	98
PID 1460 wrote to memory of 1796	1460	cmd.exe	100
PID 2372 wrote to memory of 3632	2372	2026-08-13_ce06dd0a0909c97d972449ce0bc43b98_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	101
PID 3632 wrote to memory of 696	3632	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-13_ce06dd0a0909c97d972449ce0bc43b98_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_ce06dd0a0909c97d972449ce0bc43b98_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCAACBACAABBABBCAACCBCBCCCBABACBAABACBAAABBBABBCBBAABBCAACACCBBABCCAABABBABABBBACBCCACBBCAAABBBCBCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCAACBACAABBABBCAACCBCBCCCBABACBAABACBAAABBBABBCBBAABBCAACACCBBABCCAABABBABABBBACBCCACBBCAAABBBCBCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBACCBCCAAABBABBBCCCBCCCBAAAABCCCAAACCCBCACACCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe" start= auto displayName= "UserDataSvc_BCBBACCBCCAAABBABBBCCCBCCCBAAAABCCCAAACCCBCACACCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBACCBCCAAABBABBBCCCBCCCBAAAABCCCAAACCCBCACACCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe" start= auto displayName= "UserDataSvc_BCBBACCBCCAAABBABBBCCCBCCCBAAAABCCCAAACCCBCACACCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBACCBCCAAABBABBBCCCBCCCBAAAABCCCAAACCCBCACACCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBACCBCCAAABBABBBCCCBCCCBAAAABCCCAAACCCBCACACCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5924
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBCBAAABCCACCCCACACACABBCBBCACCCBACABCBACCBABCBBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBCBAAABCCACCCCACACACABBCBBCACCCBACABCBACCBABCBBBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe
1⤵
- Executes dropped EXE
PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 36daa2da15b2d3446eef0d2c2645be9cfdfb74aea12ef25f70bd0fdd1d04479e
MD5 ec1698a5c062c115e8901da2f8fca07b
SHA1 60dd6e8914a865894cfed8283b8004d79f99a2bc
SHA512 dfd98d702f206cac8c70de6cf72d90480610c25a67a48443caf2868bf27c601853c1f0e733b264b80ce20093e591496f5c8f9950262720616998afe5dbe68c2f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c70c8204869c2d8a08f4e690a07114c2f8b555ecc3bf47e5455b68af116acd65
MD5 1fbfcfbee623ca24994c0d445eb02d0e
SHA1 f976040a2260b4911d2588f94d512c09fd099e3a
SHA512 0c3a1b7b65eea4b6039b8ed09768dd0de909e9e54a2a0b35dee154c764a9f1b2457523b51d94e40e170bc313abbcf0756b4520a7f2737d516a5cd7db48c74801
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 18d727be852cd9fe09a0f0a953aa8cd9fc9fa6e66eb20aae1badd807fee929dd
MD5 d59975f9e87738172babcf53c6b2072f
SHA1 d8eb36e146e263cd53a852280faea37e8280d9cf
SHA512 78a6fe2a24e4eb03a112b9345105f6697ac2782bf9e0c32241d6af5155351856110cfe67401a62430eb80836e7eb61df59d9aa958ba03af4b25b53dde75e043e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9191db0b7780a132cb4a1b5fe81ef522e4ec6db3cbc2ae61185dd31ce547b965
MD5 143c01764c60f1d7e5866fe9cffb827e
SHA1 ac8414d2307eb582fbbe354bf60c222f3f7621ac
SHA512 a98e9815fd52e548305fd76acfa4bd7b8af6cbca1c9ebdec088c229f3d27287460fd80f2152257d308bf5471171637a07ec7a9e141cf2fd5f79c438da8a8a14e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b18b08dd261e9052b2eb11477d2f7962bd788425858721be5c92d7655434abfe
MD5 90b62be3d8e88ffc66bdec9dee5ea76d
SHA1 03bab5e1321d9e45e08d6768943e7da5e7eb80e0
SHA512 06ea2459500e385b9006277016b65696046230514930fc066546fd194c84dbb7b8dd9b566682e4ec588cfe8d6c1e8d23142bf0af2fb765ad4533c465d7926a5b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8791b3cda98a66f93a4a18f8955c71a6092127705c1395e9965834efb17b23a8
MD5 8a7f039016294f3706b9485844e86bc7
SHA1 7e659b02118d585f8d82146c9e87f5d0e5a4feb6
SHA512 8c0dabc714ba15fe43fccaacfaadf303a33c376de83d850f6a210eda0e46c326696d8fabaf965e519f09b1aacb8754cca7bc2adcb6efa57775b5f8b7efaf555d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 105db1cb2db8e18d556570f89c6c8789a84e226b6e47b33e07a399ce4e5e45de
MD5 cf92fa8dbff394881a1425c276ebd09f
SHA1 6f1589d67b5ea6bf2986915777847a7e1ad0fcc2
SHA512 dee4a53ea5a7f51a43537b64b99045e74a74f812bd851b0d109864fe8d468c32258862f752a15b7b9900994760054ae4cf1ff9c7554cdde587225d4e0ecf5cc8
MD5 SHA1 SHA512

Submit Download

svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCABACCBCBCBCABBBCBBBCCABBBABAAACAABBABABABBAACCAAC.exe
Size 12.3MB
SHA256 254b410baf08f856bb3c02bf602ca2006ee6b39f9a566c4a4589e1cac81093f7
MD5 ce06dd0a0909c97d972449ce0bc43b98
SHA1 dcef1f386255df286c6584fe3ad6877934fabbab
SHA512 92aab076acff4161e02e68671c1cbd3ab2dad88a12749a86d8f8ba03d95d8aba3ecd8edbe6e740ffb629c31cbbcfece5c30caf36ac3ca80c7443c0d7a9578236
SSDEEP 49152:U+EPiw25+Ef+EPiw25+EkI+EPiw25+Ef+EPiw25+EkI+EPiw25+Ef+EPiw25+Ek2:5/fh6ImzzJoDfuBcMv+A73XAc
TLSH
T18ED64A05FAEE48B4E9B3623049A7C27F9671B8118732CADFD240872E9E73AD05D35716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b85b54fc1440a9a9f2696f1932dc0124acbeaadea15c38ec3b040df04b713d5d
MD5 6066a1a190ff2a18de4e12f0bd622a7c
SHA1 19d1ea193141e127468d3a06fea71361337eab5c
SHA512 7d87ea2ef08fc0ce55cb942749014aa4f37df84662550ed0fc625b808213d72620c70419629100142c56f63d4f6b973100bd7c3f7bc53513a533b5900470387c
TLSH
T12511B65194F5E033E933688FA32B9BC20C94359F9C586AA8230D531A7BD9CB3DD568D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2372-8-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download

memory/2372-0-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download

memory/4876-78-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/5924-34-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download