e79a869c82377d337d33baf2ea79f7290c20ff4d1f17ef6f13a49a59c2fa89db

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_82e62f0ba53d0c8b7a06d1fc9227ca4d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 10.5MB
Sample260813-e2lvlsbk3z
SHA256 e79a869c82377d337d33baf2ea79f7290c20ff4d1f17ef6f13a49a59c2fa89db
MD5 82e62f0ba53d0c8b7a06d1fc9227ca4d
SHA1 e2bdad358231bd4439ff66ed27aa66076d50b309
SHA512 80bede0b56a0925d16783e5ad4ad1e5722957769df4fed901ddbfee852eb337ccd248cbc65a08c1c527160d0604f10beedd2ac2d876a1226c310d7ecb1557a40
SSDEEP 49152:U+ES+E2+ES+ES+Epr+ES+Epc+ES+E2+ES+ES+Epr+ES+Epc+ES+E2+ES+ES+EprD:d/fh6ImzzJoDfuBcMv+A73XAG
TLSH
T113B66B05F98740B1E91755B00CDBE3BF8630BA158722CEE7EB488B5BF923BE15835616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
120	svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe
4932	svchost_CCBAABACBAABACBACBAACABBCCCBCACBACCBABBCABBBBBBBCCBCCCB.exe
5076	svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAAACBBAABBBBABABBBABCBBCCBBCCCBCAACACCBBBBCBBABABBBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe"	2026-08-13_82e62f0ba53d0c8b7a06d1fc9227ca4d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACBBCACBBAACABBCBCCBCBABCBCBCCCACCAACACCCACACBBCABCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAABACBAABACBACBAACABBCCCBCACBACCBABBCABBBBBBBCCBCCCB.exe"	svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4452	sc.exe
1168	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4056	cmd.exe
5368	cmd.exe
4804	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBAABACBAABACBACBAACABBCCCBCACBACCBABBCABBBBBBBCCBCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_82e62f0ba53d0c8b7a06d1fc9227ca4d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1060	2026-08-13_82e62f0ba53d0c8b7a06d1fc9227ca4d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
1060	2026-08-13_82e62f0ba53d0c8b7a06d1fc9227ca4d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
1060	2026-08-13_82e62f0ba53d0c8b7a06d1fc9227ca4d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
1060	2026-08-13_82e62f0ba53d0c8b7a06d1fc9227ca4d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
120	svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe
120	svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe
120	svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe
120	svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe
4932	svchost_CCBAABACBAABACBACBAACABBCCCBCACBACCBABBCABBBBBBBCCBCCCB.exe
4932	svchost_CCBAABACBAABACBACBAACABBCCCBCACBACCBABBCABBBBBBBCCBCCCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	2026-08-13_82e62f0ba53d0c8b7a06d1fc9227ca4d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	120	svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe
Token: SeDebugPrivilege	4932	svchost_CCBAABACBAABACBACBAACABBCCCBCACBACCBABBCABBBBBBBCCBCCCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 4804	1060	2026-08-13_82e62f0ba53d0c8b7a06d1fc9227ca4d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	91
PID 4804 wrote to memory of 2592	4804	cmd.exe	93
PID 120 wrote to memory of 2288	120	svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe	94
PID 1060 wrote to memory of 4056	1060	2026-08-13_82e62f0ba53d0c8b7a06d1fc9227ca4d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	97
PID 4056 wrote to memory of 4452	4056	cmd.exe	99
PID 1060 wrote to memory of 5368	1060	2026-08-13_82e62f0ba53d0c8b7a06d1fc9227ca4d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	100
PID 5368 wrote to memory of 1168	5368	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-13_82e62f0ba53d0c8b7a06d1fc9227ca4d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_82e62f0ba53d0c8b7a06d1fc9227ca4d_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBCAAABCBABBCCBCCCCBAAACCAABCCBBCAABABACAACBBBAAAACCBABABBCCACCBCBBCBBBACCBCBCBBCBBABCBABCCBCABBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBCAAABCBABBCCBCCCCBAAACCAABCCBBCAABABACAACBBBAAAACCBABABBCCACCBCBBCBBBACCBCBCBBCBBABCBABCCBCABBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABABBCABBACCBBACAACACABBBAABABCACCCACACABBAACCBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe" start= auto displayName= "UserDataSvc_AABABBCABBACCBBACAACACABBBAABABCACCCACACABBAACCBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABABBCABBACCBBACAACACABBBAABABCACCCACACABBAACCBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe" start= auto displayName= "UserDataSvc_AABABBCABBACCBBACAACACABBBAABABCACCCACACABBAACCBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABABBCABBACCBBACAACACABBBAABABCACCCACACABBAACCBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABABBCABBACCBBACAACACABBBAABABCACCCACACABBAACCBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1168

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:120
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABACBAABACBACBAACABBCCCBCACBACCBABBCABBBBBBBCCBCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABACBAABACBACBAACABBCCCBCACBACCBABBCABBBBBBBCCBCCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4932

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe
1⤵
- Executes dropped EXE
PID:5076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0ffce095c55896aa7940081a659c52d4e62690481fe495d0d310118227b0b69d
MD5 692876cb9a5f0c741ced260d327ffa55
SHA1 39c495e13b18b158ac3ebcf73e9f28ef4c0043eb
SHA512 0c523c4ab6a4df0b48d2d8362309aa2f21c9dd0f7f7b54ef96377943c713a993a30882ef0e508ef205b351fc8a6d316e07bc80c29a6040d9adcdc44a138b6ddf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 18f620b394aaa70e9154ee2d0297d58ad4907bf4f0886409e041c5e0428df1d2
MD5 9f8da895786579c88e5405a3ce30e497
SHA1 86fe52d87587110e20f7f407fabde3f13cf0d8aa
SHA512 36ba4a4f7abbad50165bee3cff6eb536aefcf65c703e9ff58244c0701d054b8f1b4c8f761e180a386a7cb1c919afdfd366ff40a85284649b69a403ef2c0e9acd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 12d35b570f1aed18a9b62560d5cd37ec9d16dedd9fd5d9ed6997df484563466f
MD5 41d74fa34c17257ff5f1553b11e80154
SHA1 2e5ad44fbe5165aecadecd936b0f22f1dd653e44
SHA512 9d0f5135f15a531b967b55d05a6fab3f64fa0d717f2b78b2be038fc3ceff3694ea8fc543341baf0b0f7c5129fec32bef71520e09ad283765eb50d0f751521281
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0e4d27d4f8ff55287865c092d2ea815b9519d0a932313bad7b93d4c84e521685
MD5 08ddf0d12d19c156e64f716ee8c5cf23
SHA1 a4aa98fd0b70c0a5398b4e733a04672f8b40af36
SHA512 b55c6bd60c81e31dc38baaee36682ebd5cac62468158b9caf4b7542088be0be9f2069654d13d034d8e89f93c329da4ecfa5b92956de51fe525c75759f4db490a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a05def79ef768aed10d3dbae65227706b832f4d8e780fa4543f426f548d34535
MD5 02852801f801cdc4f1f1e80c1f3a8f50
SHA1 3a951a47c7a88f98bdf13e43d63e19ab7a9bb5e9
SHA512 7876d5ea468443597c758111fc7b74935da7f1b8cf5f874655c5a7b6bfec40f95717ed17756de9c22112eeb6369ae4160a8b28249a57ee14ccfd78213d7ea931
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0c13d932bd9209a9357b947d93b18af2c72a55e1521a01d61bb0237092dd5357
MD5 8b1e8c23337364328b1a27df1a88bf52
SHA1 ed44c590099d5703909fbbc42fa33828965e3313
SHA512 aa9c889e60ee1b912022672f03d763e83eb0944078ddb61284a5862eca7da0ddd293862cec2a50f987a4232dc379fa34f24bc1f274999b77b27e64299a459ca8
MD5 SHA1 SHA512

Submit Download

svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBBBCBBAAABCBCBCCBCABABABACBAABCCCACBBAABCABBCCBCB.exe
Size 10.5MB
SHA256 e79a869c82377d337d33baf2ea79f7290c20ff4d1f17ef6f13a49a59c2fa89db
MD5 82e62f0ba53d0c8b7a06d1fc9227ca4d
SHA1 e2bdad358231bd4439ff66ed27aa66076d50b309
SHA512 80bede0b56a0925d16783e5ad4ad1e5722957769df4fed901ddbfee852eb337ccd248cbc65a08c1c527160d0604f10beedd2ac2d876a1226c310d7ecb1557a40
SSDEEP 49152:U+ES+E2+ES+ES+Epr+ES+Epc+ES+E2+ES+ES+Epr+ES+Epc+ES+E2+ES+ES+EprD:d/fh6ImzzJoDfuBcMv+A73XAG
TLSH
T113B66B05F98740B1E91755B00CDBE3BF8630BA158722CEE7EB488B5BF923BE15835616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 8f4191d44e27f230c6bea735a9c659536fb8562d338c290682973a7a64fc7735
MD5 25d4de7093a0024c5758df02e42c81e6
SHA1 5b3b03aaa0485720f3684f46c471ac03a1ed81ab
SHA512 777ee51f843e6e0ea02489c445a886b93c7a0d93451e56afa13a1b11e5549ba9f2cfd390ece11c66b8860c599e927d23c3dbc29d22de3d92b358d01cf6f696ad
TLSH
T13B110D516CE6EC67EC3364CB733A8ED718DC37AB589C7A98220CC219A355D724D514F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/120-34-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/1060-0-0x0000000000930000-0x0000000000951000-memory.dmp

Download

memory/1060-8-0x0000000000930000-0x0000000000951000-memory.dmp

Download

memory/4932-74-0x0000000000740000-0x0000000000761000-memory.dmp

Download