e58a41d3fa8b5d1b14e22406c0610ff39f6d87aff960a6eaaa662ecd0bba3550

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_c05bfa5aba31c7771086e41368451352_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 8.4MB
Sample260814-dvanbstvbw
SHA256 e58a41d3fa8b5d1b14e22406c0610ff39f6d87aff960a6eaaa662ecd0bba3550
MD5 c05bfa5aba31c7771086e41368451352
SHA1 c807a7dde216ee09160c278ac05f5331de661d80
SHA512 bd9d8f1c20d72987e0cabfcc2321c0a80c14981b76aa69c6fe22bf9895a82d395e505f3cadce164dbf68303fbf79d0dd2b6436609b257552438326bd01ca1d3d
SSDEEP 98304:IHHHHHHHO/fh6ImzzJoDfuBcMv+A73XAy:JHh6ImzD+Fy
TLSH
T15B968C04FADB40F4EA23453048A7927F9631B9258731CEDBD784CA7AED23BD16935B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4876	svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe
3000	svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe
4340	svchost_CBABCCACBACAABCBACCBCBCBCBABBBBCCBBBCCCACACACBBBACBBABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ACACBBACCAACACBBCBCCBABCBBACBAACCACBCCBBCBCABBBCBACBCBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe"	2026-08-14_c05bfa5aba31c7771086e41368451352_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCCBCBCBCACBABACBBCBBAACBBAABBBABABCBCACBABABCABBBAAAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABCCACBACAABCBACCBCBCBCBABBBBCCBBBCCCACACACBBBACBBABB.exe"	svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3988	sc.exe
2352	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1828	cmd.exe
1560	cmd.exe
3948	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABCCACBACAABCBACCBCBCBCBABBBBCCBBBCCCACACACBBBACBBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_c05bfa5aba31c7771086e41368451352_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2120	2026-08-14_c05bfa5aba31c7771086e41368451352_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2120	2026-08-14_c05bfa5aba31c7771086e41368451352_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2120	2026-08-14_c05bfa5aba31c7771086e41368451352_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2120	2026-08-14_c05bfa5aba31c7771086e41368451352_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4876	svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe
4876	svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe
4876	svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe
4876	svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe
4340	svchost_CBABCCACBACAABCBACCBCBCBCBABBBBCCBBBCCCACACACBBBACBBABB.exe
4340	svchost_CBABCCACBACAABCBACCBCBCBCBABBBBCCBBBCCCACACACBBBACBBABB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2120	2026-08-14_c05bfa5aba31c7771086e41368451352_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	4876	svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe
Token: SeDebugPrivilege	4340	svchost_CBABCCACBACAABCBACCBCBCBCBABBBBCCBBBCCCACACACBBBACBBABB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3396	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 1560	2120	2026-08-14_c05bfa5aba31c7771086e41368451352_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	95
PID 1560 wrote to memory of 2480	1560	cmd.exe	97
PID 2120 wrote to memory of 3948	2120	2026-08-14_c05bfa5aba31c7771086e41368451352_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	98
PID 3948 wrote to memory of 3988	3948	cmd.exe	100
PID 2120 wrote to memory of 1828	2120	2026-08-14_c05bfa5aba31c7771086e41368451352_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	101
PID 1828 wrote to memory of 2352	1828	cmd.exe	103
PID 4876 wrote to memory of 1684	4876	svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe	105
PID 1684 wrote to memory of 2928	1684	notepad.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-14_c05bfa5aba31c7771086e41368451352_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_c05bfa5aba31c7771086e41368451352_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCCAACCACAAAABAABCCCCCACABAABABCABABABABBCCBCABBBBBBBACCBBACABBCABCCBABACBCAABACABBAACBACCBAACBCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCCAACCACAAAABAABCCCCCACABAABABCABABABABBCCBCABBBBBBBACCBBACABBCABCCBABACBCAABACABBAACBACCBAACBCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACCCBABBCBCAABACACBBCAABACBBABBBBBBBBABCCCBAACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe" start= auto displayName= "UserDataSvc_CCACCCBABBCBCAABACACBBCAABACBBABBBBBBBBABCCCBAACBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACCCBABBCBCAABACACBBCAABACBBABBBBBBBBABCCCBAACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe" start= auto displayName= "UserDataSvc_CCACCCBABBCBCAABACACBBCAABACBBABBBBBBBBABCCCBAACBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACCCBABBCBCAABACACBBCAABACBBABBBBBBBBABCCCBAACBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACCCBABBCBCAABACACBBCAABACBBABBBBBBBBABCCCBAACBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2352

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe
1⤵
- Executes dropped EXE
PID:3000

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCACBACAABCBACCBCBCBCBABBBBCCBBBCCCACACACBBBACBBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCACBACAABCBACCBCBCBCBABBBBCCBBBCCCACACACBBBACBBABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 60c848d34b5696fa37cd96204a6a1740e095491d699bdafc224171efba50c426
MD5 39bacfa7f24c9654063b12d79d66848f
SHA1 af7f11473c95531feeaa6d39a8477cbcea861a92
SHA512 8f3d7f276d3d0520f4de1e200dbf49a301d53f53bc44f486f3bfafccac8132ccd2eefabd07200e36ae984386b0fdb032ff920242c3aeabc958b79f46347c4be8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 55a1be1390666d51e92fdfa1a2654c2f0a75858c71cdc5be533e8556c1da1ac0
MD5 e2ccef6afea06355917646e04a9619e2
SHA1 0252390af81056a3ff2f88d290d79edf5bf329e9
SHA512 094feefacbca0f4b5e409598a22d657c99bbbeadf86ca542cfe515efa145b2c0628212eefbc7a7a44341dceb05a6515d94fe3e9bc7fda4a86a4b3c4bf12d0644
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cc452b0ad6281941356fd51530a96fef33be68926a2cfdc049f6bc997bf65930
MD5 8b12346d242ffd0489170de44df22a20
SHA1 89203047a048c08bc240245ca9a0f019550d2b10
SHA512 149f73f622810814e093937877a22a7da06e96b6a233e610386a9f5150fba341fc64ccf726b88b135165b05910f13080f8cc399e2fd213d4f2c823291f7fdf85
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 af7855e582a1f8c7c1b6b4ce363b5f84c78584afaef2d8901b349fe7d42ea45b
MD5 cfce7897c0539e58adee5652281ba65b
SHA1 48be33d78bfe5f38282445724358712de2c6c8e3
SHA512 18a6d350e5f396ffc16977b3e257b3ecda3f0ed88b3f846ea8dffe5d4eea953e34dea872d523b8c5bf7417c18f318f5f8cdd3e923313636f6b14ad57931b4011
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 178f9a2c43a125895ceed51a96b15389a741748f108bd73f50f4c7499e79c61b
MD5 5689c97bcc8f9671ba9c8d6a0a603283
SHA1 f0f959fecee10c5ae3eb60b188c5b02374c26826
SHA512 238020ae49f8a497b9f671a87b42995de9c097fda7988d7f55e043ae8bc73c1495150f8b827e79e057ca8cfd6b89330c90c39de2191f3d9dbf6125f9dc24c898
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 07466d332d3129c681705d894b637f183e86f6ee863d1467c942f508c38fd627
MD5 0c96b80e9186b2a6cff445837c366a07
SHA1 b4e5e609a84f516be49d973edda418cbecab19df
SHA512 8ece7d0d614732c6eb4759d5b9226813b61bc062083cba0ef59d90c99bd44f73dae401368d9c9a27cd17e337267acd35358a5e2b516d8f2014d32d257fa36ebf
MD5 SHA1 SHA512

Submit Download

svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABCBCBBBBABAAACBBACCBBBACCACACABBCACACACCBABCAAABA.exe
Size 8.4MB
SHA256 e58a41d3fa8b5d1b14e22406c0610ff39f6d87aff960a6eaaa662ecd0bba3550
MD5 c05bfa5aba31c7771086e41368451352
SHA1 c807a7dde216ee09160c278ac05f5331de661d80
SHA512 bd9d8f1c20d72987e0cabfcc2321c0a80c14981b76aa69c6fe22bf9895a82d395e505f3cadce164dbf68303fbf79d0dd2b6436609b257552438326bd01ca1d3d
SSDEEP 98304:IHHHHHHHO/fh6ImzzJoDfuBcMv+A73XAy:JHh6ImzD+Fy
TLSH
T15B968C04FADB40F4EA23453048A7927F9631B9258731CEDBD784CA7AED23BD16935B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 6c5f8b042529221a694b81af22f24b3c9b26795a46a29623b692764c11c82642
MD5 cbd4949b7ca206e3f796756b4ceeac78
SHA1 fb2ecd46d7f7abb506c827ca537a09ce47b1d4e6
SHA512 54bf2c2b7fcc0a2c5cb23c2787087a96039c319691d645c13296c1db81dc09e026a8071b8dca935030e6ae0e7875871ddd74cbee20dcb8700bdec6d7a7f1b1e7
TLSH
T172112C50D4E5E463E83168CB631ADFD30CE9B75FA8586AA62309422C7F59C338E510D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1684-67-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/2120-0-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/2120-7-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/3000-75-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/4876-39-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/4876-26-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download