3f2042254b6f89a5ee6de7f7b3d78cf5b46cfa5fe30a414c7a04e02909a52142

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_7a0b4796092c9662196e246f141f3881_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 10.7MB
Sample260813-e6c39sbk7v
SHA256 3f2042254b6f89a5ee6de7f7b3d78cf5b46cfa5fe30a414c7a04e02909a52142
MD5 7a0b4796092c9662196e246f141f3881
SHA1 6eae9f93bca6d15e3bde9603645c196c36485e73
SHA512 48eb11bb63360091b2befdfdb74d82e926472241b1518f4babb646c64e3fee7cb3da174b6bcb13cb0616f304ea0f7099c39df6f1b7dd49db3184b89c163469a9
SSDEEP 49152:U+E2+ES+E6gyiw2J+E2+ES+E6gyiw2J+E2+ES+E6gyiw2J+E2+ES+E6gyiw2J+EC:J/fh6ImzzJoDfuBcMv+A73XAD
TLSH
T150B66B05FADF44B4E963613049A7C27F9632B9118731CBDBD2848B2EAE33AE15D31716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5592	svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe
4444	svchost_ACAACCBBBBBABCABCCAACBCABCBAAAACCBBCACCABBACCCBABABBBCA.exe
1056	svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACBCCABBCACBABBBBCACACBCAACBBAACBAACACBABCCAACCBCAABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe"	2026-08-13_7a0b4796092c9662196e246f141f3881_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBCBBBBCABACCABACBAAABBCACABBBABCBBCBBACCAACAABBCBBCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAACCBBBBBABCABCCAACBCABCBAAAACCBBCACCABBACCCBABABBBCA.exe"	svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3052	sc.exe
4172	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3592	cmd.exe
2932	cmd.exe
2148	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAACCBBBBBABCABCCAACBCABCBAAAACCBBCACCABBACCCBABABBBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_7a0b4796092c9662196e246f141f3881_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5400	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5776	2026-08-13_7a0b4796092c9662196e246f141f3881_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5776	2026-08-13_7a0b4796092c9662196e246f141f3881_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5776	2026-08-13_7a0b4796092c9662196e246f141f3881_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5776	2026-08-13_7a0b4796092c9662196e246f141f3881_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5592	svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe
5592	svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe
5592	svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe
5592	svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe
4444	svchost_ACAACCBBBBBABCABCCAACBCABCBAAAACCBBCACCABBACCCBABABBBCA.exe
4444	svchost_ACAACCBBBBBABCABCCAACBCABCBAAAACCBBCACCABBACCCBABABBBCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5776	2026-08-13_7a0b4796092c9662196e246f141f3881_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	5592	svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe
Token: SeDebugPrivilege	4444	svchost_ACAACCBBBBBABCABCCAACBCABCBAAAACCBBCACCABBACCCBABABBBCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5776 wrote to memory of 3592	5776	2026-08-13_7a0b4796092c9662196e246f141f3881_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	91
PID 3592 wrote to memory of 5400	3592	cmd.exe	93
PID 5592 wrote to memory of 4720	5592	svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe	94
PID 5776 wrote to memory of 2932	5776	2026-08-13_7a0b4796092c9662196e246f141f3881_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	97
PID 2932 wrote to memory of 4172	2932	cmd.exe	99
PID 5776 wrote to memory of 2148	5776	2026-08-13_7a0b4796092c9662196e246f141f3881_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	100
PID 2148 wrote to memory of 3052	2148	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-13_7a0b4796092c9662196e246f141f3881_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_7a0b4796092c9662196e246f141f3881_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBBACAABBCBACBCAACABBCCABBCAACCABABBCAAABAACACAACAACCCCABAACCBBABBABCAACCABCCACACBBACBCABBACBACCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBBACAABBCBACBCAACABBCCABBCAACCABABBCAAABAACACAACAACCCCABAACCBBABBABCAACCABCCACACBBACBCABBACBACCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCAACACCBCBABABBBCAACCCABCBACCBCABCBCCBCCBBACAABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe" start= auto displayName= "UserDataSvc_CBCAACACCBCBABABBBCAACCCABCBACCBCABCBCCBCCBBACAABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCAACACCBCBABABBBCAACCCABCBACCBCABCBCCBCCBBACAABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe" start= auto displayName= "UserDataSvc_CBCAACACCBCBABABBBCAACCCABCBACCBCABCBCCBCCBBACAABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCAACACCBCBABABBBCAACCCABCBACCBCABCBCCBCCBBACAABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCAACACCBCBABABBBCAACCCABCBACCBCABCBCCBCCBBACAABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCBBBBBABCABCCAACBCABCBAAAACCBBCACCABBACCCBABABBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCBBBBBABCABCCAACBCABCBAAAACCBBCACCABBACCCBABABBBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe
1⤵
- Executes dropped EXE
PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 674991e28702a9155fe66239a3a6c7bba017b24e934af3a1777fb1c2db8c99a4
MD5 3003f4a1edd394b90098130fa9e51174
SHA1 07536dfaff8773c03ca1c230642e6765e2a45f1b
SHA512 8a3dea7af9d75fabb7fa814ea77b7fd1fd3647dcac9368ec0fa2001eab0d28dbcf2a8ee61283d4294435ff7e0f71365fb28004a2855a849bd3c43d6e2d70ae32
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0c2fda6b1f12b29dad36ffb82d76256770a354206f39c4d912c053420867a725
MD5 ba46d01d0d8405699d52d34848161291
SHA1 0b03c907ba6689bbe5d411d563ff36001de29733
SHA512 fb59ec186dae95bcc9033be2417393c42900f62f2f79cecad771f6daf0e5d1419ad47705f19eec134a8db7e6f7bb99bd160c12486b3c5db9b9b9b29bfa1bd1e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f9d1b44a85efb3c57de822b7f189187db8694e7004830706cbac392cf9082e14
MD5 b6ac3f892c706a6194bed724299b8008
SHA1 8d523d069c713570e604bba932678e42b72c4ef7
SHA512 d2c59c9696d8fd6e5ff8f74cfe406b85cc21eafcb786794bc201f5672f31ec455eea1b763181cfe507e9df0f11960c1ac85e936de933b19306c5e03b206bb0d5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7cda3f85b9caf5fa550d046856054550e919c00c48921cfdbcc86a33461638f5
MD5 43d8ee317c8634b5e39c3f1e06402d0c
SHA1 e7d9123b29666f87d07be781c7ef3a39f31f77ec
SHA512 f47dc7f25a47284de52c4e6e62aa81245b6fc63cae9bd11bde9fad58c5668486ed02166e9a148e192024feaca3c4260ca1b2eff39a39063febb06296a087e754
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e0309c7d8cc0365dcfeeb21655812df3741c4f5a7760cd2c18aa223c3df9d222
MD5 5ed577a6f090cbb3ef5c90d420f2d9b4
SHA1 c0bccf484f4eb7c31f8825ca26fc6c88e6dbec08
SHA512 8e9611b2efe1904b6852ee4433d5d07baa869fb8efda9b1df548d9ce1f09b2ad50823698524cda7c0e25bbaadd6ee01941f16cfbd7cc38be170e646b7c5d921a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 33cea0360d8b16039248eeb41882f69f8407fda18edf89fde0a715e7006d9df4
MD5 b814191a4694f761596fa33ac619d9e7
SHA1 0ee5801e932832e795c78ebf3c4ab7655ddadebd
SHA512 62ab1d34ae33a9e02b6588bfaf6f7833f164241014046219ddeee63b155e522617df3dc6c72b15216c71847edf94c54c92c84647741b57c27f2805231a029c14
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f7b9a001edc28024dc7747d5091c63a9f96802d211d3040e361f095ab5169e5d
MD5 80ba0b4d573f3cd086cdbb5c38548367
SHA1 dfd350d7ddf65f484aab6b14738d62a11772cb70
SHA512 7b18b5adf27524f9b52a7712ac031ee5054bd4bd37e044094adb8d1a7f5fbefde786d96d86ad52277e2fe584202b096f79f9a0bbebd6e7ad8d4d85a9a04ac5c9
MD5 SHA1 SHA512

Submit Download

svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBCCCABBACAAAAABABABBCACACCBBACACBACCBBAACBBACBCBB.exe
Size 10.7MB
SHA256 3f2042254b6f89a5ee6de7f7b3d78cf5b46cfa5fe30a414c7a04e02909a52142
MD5 7a0b4796092c9662196e246f141f3881
SHA1 6eae9f93bca6d15e3bde9603645c196c36485e73
SHA512 48eb11bb63360091b2befdfdb74d82e926472241b1518f4babb646c64e3fee7cb3da174b6bcb13cb0616f304ea0f7099c39df6f1b7dd49db3184b89c163469a9
SSDEEP 49152:U+E2+ES+E6gyiw2J+E2+ES+E6gyiw2J+E2+ES+E6gyiw2J+E2+ES+E6gyiw2J+EC:J/fh6ImzzJoDfuBcMv+A73XAD
TLSH
T150B66B05FADF44B4E963613049A7C27F9632B9118731CBDBD2848B2EAE33AE15D31716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3dd980ff873478111229d68f5e012934c2b94fe8a1e48a5c27ff0201192e9c35
MD5 2234633827b4e9fb7a146a0feb9ce73e
SHA1 decf76d6287ff6f3906cb3579d9db11e28af1e28
SHA512 b159836e76555318350fe59afebcd863546217caa56517d87cc4bea3a5ed63d348f16440f9c99d6ea1a3687e2cda8b5d3336c9ae2530badbccd5d866357da972
TLSH
T16C112B20D8E5C863FE3368CFAA3FCA821CD4335B9D98BA182309411A6B98D724D558D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4444-71-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/5592-34-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/5776-8-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/5776-0-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download