e267b75ec916c62586954c9918b052127536a8cccb46f5f67ca87eaffb49796d

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_644f35711946b1f73587d41e12c7c936_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 13.4MB
Sample260813-ld69zaen21
SHA256 e267b75ec916c62586954c9918b052127536a8cccb46f5f67ca87eaffb49796d
MD5 644f35711946b1f73587d41e12c7c936
SHA1 f3b51a86b7d470fc70b07aa2f95d60f3acd85cc8
SHA512 5aabaf3a5117d90491149bd6a34c5469624063a0b63c4469d5304e2d16c4ddc4394324be8d037dc8ea4579e222ce6f1033d0d4a425c78ef21d200ecf2d7cedfd
SSDEEP 98304:OKRuy5a8KRuy5a8KRuy5a8KRuy5a8KRuy5a8KRuy5a8KRuy5a8KRuy5a8KRuy5aZ:OqXqXqXqXqXqXqXqXqiHh6ImzD+FD
TLSH
T19BE6AE12E6D740B1EA633530456BA37F6A3D77104735CACBC7440E7AAE23AC15A3A35B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1152	svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe
3108	svchost_CABABBBCCAAACCAAAAAAABABCBAACBACBBCACAABABCBCCBBBCCABAC.exe
4980	svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCCCABACCABBBBCBBAACBCABBCCCBBBACCBAAAACAABCCCCACAAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe"	2026-08-13_644f35711946b1f73587d41e12c7c936_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBACCCABABCCBCCBCCCBACBBCCCAABCBCAACBCBBCCCBBBCBACCBCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABABBBCCAAACCAAAAAAABABCBAACBACBBCACAABABCBCCBBBCCABAC.exe"	svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
780	sc.exe
3392	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2484	cmd.exe
5160	cmd.exe
1464	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_644f35711946b1f73587d41e12c7c936_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABABBBCCAAACCAAAAAAABABCBAACBACBBCACAABABCBCCBBBCCABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3412	2026-08-13_644f35711946b1f73587d41e12c7c936_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
3412	2026-08-13_644f35711946b1f73587d41e12c7c936_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
3412	2026-08-13_644f35711946b1f73587d41e12c7c936_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
3412	2026-08-13_644f35711946b1f73587d41e12c7c936_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
1152	svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe
1152	svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe
1152	svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe
1152	svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe
3108	svchost_CABABBBCCAAACCAAAAAAABABCBAACBACBBCACAABABCBCCBBBCCABAC.exe
3108	svchost_CABABBBCCAAACCAAAAAAABABCBAACBACBBCACAABABCBCCBBBCCABAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3412	2026-08-13_644f35711946b1f73587d41e12c7c936_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	1152	svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe
Token: SeDebugPrivilege	3108	svchost_CABABBBCCAAACCAAAAAAABABCBAACBACBBCACAABABCBCCBBBCCABAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 2484	3412	2026-08-13_644f35711946b1f73587d41e12c7c936_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	92
PID 2484 wrote to memory of 2740	2484	cmd.exe	94
PID 1152 wrote to memory of 2304	1152	svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe	95
PID 3412 wrote to memory of 5160	3412	2026-08-13_644f35711946b1f73587d41e12c7c936_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	98
PID 5160 wrote to memory of 780	5160	cmd.exe	100
PID 3412 wrote to memory of 1464	3412	2026-08-13_644f35711946b1f73587d41e12c7c936_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	101
PID 1464 wrote to memory of 3392	1464	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-13_644f35711946b1f73587d41e12c7c936_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_644f35711946b1f73587d41e12c7c936_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABACBABCCCCBABCABCBCBACBACBBAAACBBBACCCACAAAACCAAAACBACCABBAAAACAABBCBABACCCABBCCAABBAACAAAABAABABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABACBABCCCCBABCABCBCBACBACBBAAACBBBACCCACAAAACCAAAACBACCABBAAAACAABBCBABACCCABBCCAABBAACAAAABAABABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBAABBABBABBBABAAACCACABBBBBCCAACCAAAABACBAABABCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe" start= auto displayName= "UserDataSvc_ABBAABBABBABBBABAAACCACABBBBBCCAACCAAAABACBAABABCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5160
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBAABBABBABBBABAAACCACABBBBBCCAACCAAAABACBAABABCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe" start= auto displayName= "UserDataSvc_ABBAABBABBABBBABAAACCACABBBBBCCAACCAAAABACBAABABCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBAABBABBABBBABAAACCACABBBBBCCAACCAAAABACBAABABCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBAABBABBABBBABAAACCACABBBBBCCAACCAAAABACBAABABCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2304

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABBBCCAAACCAAAAAAABABCBAACBACBBCACAABABCBCCBBBCCABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABBBCCAAACCAAAAAAABABCBAACBACBBCACAABABCBCCBBBCCABAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe
1⤵
- Executes dropped EXE
PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 26fce01fbd9a71701cb52eedaefed07275d116c9c99862e2cfad2cd52895d653
MD5 707472752c2f7dc11f05b90042982b18
SHA1 28e129fdd98b452aa88f3c479911d56512207dc0
SHA512 9e8de7ed207fd30fc5077f73d559188c3df42dc241cd28d4987cd777c4e732402d9641671c26190c366250ffee3a79b923185e2bea3c56b7d490886d5701b278
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4dd1356d11af680360d9d8c021aa60ddab4d33cafceddc22927317e68584e830
MD5 ed30cfd29221e8f03d20736fcaa81745
SHA1 ab4dcbbc3adffc53e8344200e2d480cc274c6a26
SHA512 172d92b0faf43d4bae174fd5f599fa30a551ccb5f02c6f17eb992dac96b780ccd57054e38eeed1a4b9737d59a8edbe108b1898a75f1fc40c93f8c6ccc596f6e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0b7e5d691ae15ce04132dafa5fcdfb6221276aa71d7ed9e1ee378ac61d2ef143
MD5 6c63a9292b5725260264d7944b078102
SHA1 98d68ae7804fafba21617939b1b96d79274f7857
SHA512 a4b47042f2915a9f4c81223d0152963aaf70947aabe648ed6df3e22c6ce22985d30c17680781812e316e676a1a8067615e3f2aef5a9f3e6090e3213e19c91499
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f5bb67afdda6e5cdda5f239f6e6e0fbb591ee015a590197ca8043a729dd4cd46
MD5 d034db40c3389cb4922e21679f3c543b
SHA1 c1e0db6da48ba099c125fe9f64c53935bfb4f3bb
SHA512 fafb1daf154735daf4a3dde5623aeafe20cfb7f59c35fd6c2f3cba93acd88d3a86f764ce99fd0a6897d062beb8f8938cb2ea440bc07ab2bae7073696f445bc4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f4db8e05090e51a584866962f37876623d599c5e01e2e9f816ae15d24f8548fd
MD5 383a0fa8fe296777fc6b5812448e7a85
SHA1 210ce23099d497e84d1762434c9172b1c4888c0d
SHA512 c83cc0228a6554e37fc725400bb78ab33c3e86761782bd0bbc2c47ff0bdfd2b7b1f64d2740702ea54db50c5f1a4902465a4eb9b1a204811b12ea685fe6a0dc8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4fa1c0bc5a8a01778b683a7e15a5b4330b1c24dff3d5b71d2309b940f662b782
MD5 a85dc16dfe111d8371022d92c523eff2
SHA1 06424c9e768ff4456bfa446b5889bf6c11492b0b
SHA512 a00fd9adac46136f607e707f47477c7d21cd88464bee901f43d6f0ad9c29dfc5d4440d97ad62b9e8d0657badeb1ebe71f7f7b6213398fe1ce08daf718a5cda75
MD5 SHA1 SHA512

Submit Download

svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCBABAACAABBCAAACACCABBBABCCBCBABBABCAACABAAAACCBACB.exe
Size 13.4MB
SHA256 e267b75ec916c62586954c9918b052127536a8cccb46f5f67ca87eaffb49796d
MD5 644f35711946b1f73587d41e12c7c936
SHA1 f3b51a86b7d470fc70b07aa2f95d60f3acd85cc8
SHA512 5aabaf3a5117d90491149bd6a34c5469624063a0b63c4469d5304e2d16c4ddc4394324be8d037dc8ea4579e222ce6f1033d0d4a425c78ef21d200ecf2d7cedfd
SSDEEP 98304:OKRuy5a8KRuy5a8KRuy5a8KRuy5a8KRuy5a8KRuy5a8KRuy5a8KRuy5a8KRuy5aZ:OqXqXqXqXqXqXqXqXqiHh6ImzD+FD
TLSH
T19BE6AE12E6D740B1EA633530456BA37F6A3D77104735CACBC7440E7AAE23AC15A3A35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5aeda51acfe46bb5c9f0c3644b93196e57ec86efdfee3489a83c51e4753e1bff
MD5 be15b288dd390a74b3053ce408699213
SHA1 33d903b550b9dad5f9621a688da0b803c187b4b6
SHA512 509c5fd63e1962958ad335c2d445044b5b4a54c8cebb84ce890a101c3d556d4e7471ef97dfc6c27c7eee0b00b40f14ab9021ca9746d87b043a118664b4988ae5
TLSH
T1EB1108B274B5CC23FD7368C6722AEA430CA8325F585C7B8813098119A695C72CE158F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1152-34-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download

memory/1152-24-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download

memory/3108-79-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/3412-0-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/3412-7-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4980-80-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download