c73667d2c170197d89e05ba176178f7d41cb5843c6ef2d76c84848f741dc5c26

Analysis

max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_9592d71e19d3918bdd7d6823f8812a9e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 7.8MB
Sample260814-ebd23styas
SHA256 c73667d2c170197d89e05ba176178f7d41cb5843c6ef2d76c84848f741dc5c26
MD5 9592d71e19d3918bdd7d6823f8812a9e
SHA1 724f504e646321c4b169fab22b862bca5d8496b3
SHA512 527e24f8ac16ea42e9f2afd9328f995b820780ef65b1a0ec5d5593f88e5f0c6724556a98e04252b79e5f6add931f690da764b213c995c31680ceb42db26a59d4
SSDEEP 98304:fTTTTTTTF/fh6ImzzJoDfuBcMv+A73XAa:JHh6ImzD+Fa
TLSH
T1C9867D41FD8B94B2E9070171489BD3BF5330B9058B21CBD7E7889B6EE933BD11A36256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5248	svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe
960	svchost_BACCBAABACACCACABCCCBACABBCABCCBABBCBACBACAAAAACCBBCCCC.exe
1228	svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBBCBCACBBCBAACACBAACABCABCCCABBBAACBABCAAABABAAABBACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe"	2026-08-14_9592d71e19d3918bdd7d6823f8812a9e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBABCBBBCCBAABCCBCCAAAABAABCBACACAAABCBBBBCAAAAAABCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCBAABACACCACABCCCBACABBCABCCBABBCBACBACAAAAACCBBCCCC.exe"	svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5596	sc.exe
5240	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1308	cmd.exe
5116	cmd.exe
468	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_9592d71e19d3918bdd7d6823f8812a9e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCBAABACACCACABCCCBACABBCABCCBABBCBACBACAAAAACCBBCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4984	2026-08-14_9592d71e19d3918bdd7d6823f8812a9e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4984	2026-08-14_9592d71e19d3918bdd7d6823f8812a9e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4984	2026-08-14_9592d71e19d3918bdd7d6823f8812a9e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4984	2026-08-14_9592d71e19d3918bdd7d6823f8812a9e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5248	svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe
5248	svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe
5248	svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe
5248	svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4984	2026-08-14_9592d71e19d3918bdd7d6823f8812a9e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	5248	svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 1308	4984	2026-08-14_9592d71e19d3918bdd7d6823f8812a9e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	93
PID 1308 wrote to memory of 2376	1308	cmd.exe	95
PID 5248 wrote to memory of 4108	5248	svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe	96
PID 4984 wrote to memory of 5116	4984	2026-08-14_9592d71e19d3918bdd7d6823f8812a9e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	99
PID 5116 wrote to memory of 5596	5116	cmd.exe	101
PID 4984 wrote to memory of 468	4984	2026-08-14_9592d71e19d3918bdd7d6823f8812a9e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	102
PID 468 wrote to memory of 5240	468	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-14_9592d71e19d3918bdd7d6823f8812a9e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_9592d71e19d3918bdd7d6823f8812a9e_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABABCABCAAABCBCCBBBBAABBCACCBCACCABBAAAABABCAAAACBBCBCAAAAACBACBBBCCCCCBACCACACBCCAABACCAACCCBACBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABABCABCAAABCBCCBBBBAABBCACCBCACCABBAAAABABCAAAACBBCBCAAAAACBACBBBCCCCCBACCACACBCCAABACCAACCCBACBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCACCCBACCABBBBACCCACABBAACCAABAACBCABBBCAABBCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe" start= auto displayName= "UserDataSvc_BBCCACCCBACCABBBBACCCACABBAACCAABAACBCABBBCAABBCACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCACCCBACCABBBBACCCACABBAACCAABAACBCABBBCAABBCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe" start= auto displayName= "UserDataSvc_BBCCACCCBACCABBBBACCCACABBAACCAABAACBCABBBCAABBCACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCACCCBACCABBBBACCCACABBAACCAABAACBCABBBCAABBCACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCACCCBACCABBBBACCCACABBAACCAABAACBCABBBCAABBCACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5248
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBAABACACCACABCCCBACABBCABCCBABBCBACBACAAAAACCBBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBAABACACCACABCCCBACABBCABCCBABBCBACBACAAAAACCBBCCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe
1⤵
- Executes dropped EXE
PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b4c1cf2002490c6e850e73747e59e346eef8a183f31c12f1b8a973611cd380b8
MD5 e74ca9d60c6e72ddb1188ca97ca4264f
SHA1 815e6febd82c3f9cf9f509fa547299b9f8f7491c
SHA512 2db1b1aa643776efde6c74c414796e3f5807d4a12d6bcb20c461bb7c7779c923a5a6e549da7e7279358ca1758fced8c855a9a00f20035d42759c2109959d05ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 67d8fce53188dcf77d8200e2ab339f8745dc597f77446a85dbc502e5e3d98fbe
MD5 834e75fcdfe5764e9ff601e92d88f72d
SHA1 73f23e1528094346313821907e4641e8e4e91461
SHA512 4952522b13afbc8408c59dea4537f54e35fec38ed1a250bef93680312fafdf46da43dd5807a79a53e84dee71d316734e5407ce7bc6279584ed0edcc899f36c9b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 531a0b3ae24e3ad8a2c9848a65473be77bfc75af5db91c6955949a06a7d8c95d
MD5 815ce732dfa6fd0a747c8d86a9d5bd5f
SHA1 dbf596c3eafb8b4760bc5085e396adc279e8971d
SHA512 133919ec7bf4d23b88b3996a6afdb14fa57b3889a940b8a84737939e5a64248afc415c42b4f1d586e386d6cc18b5058e7da418935579c9cb8dc04cb22c38e43f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f39494811db4ba965458e6bf1f7403b2f26c57965a88c9c97a05cdb2ae1acc81
MD5 555648e87e7da28499a925e2562e5547
SHA1 666c31cc6223e64d63565fa93aa60cc8f2b10017
SHA512 5c5f8256aee8ffc09e5393b001f79e81e3422276030c3ea4390f85f8e548872df210b081252eade1ecf655c637ed0242d6d0a39da83f92ec1f7b63be495cfc7c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d3334dbd8e08d207dc5efd14afe0fd850fbfd295028ebb8f6955dd381fc5fff7
MD5 d1462378e4137659cbeb927ca29ee39d
SHA1 fd84e57ebc13f7b231c4fb28efb9d15be79e5993
SHA512 ab34d4064e985ad556ebf9bd500415789a79795ac11f984cb3ebe6c6c8a936d7459dd43aa8fff23e90847847e5e1177414d161be02f73e17c5036e06e9c03a75
MD5 SHA1 SHA512

Submit Download

svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAACCBAABABABACBACCCCCBACCCBCABACBBCACBBBBCACAAA.exe
Size 7.8MB
SHA256 c73667d2c170197d89e05ba176178f7d41cb5843c6ef2d76c84848f741dc5c26
MD5 9592d71e19d3918bdd7d6823f8812a9e
SHA1 724f504e646321c4b169fab22b862bca5d8496b3
SHA512 527e24f8ac16ea42e9f2afd9328f995b820780ef65b1a0ec5d5593f88e5f0c6724556a98e04252b79e5f6add931f690da764b213c995c31680ceb42db26a59d4
SSDEEP 98304:fTTTTTTTF/fh6ImzzJoDfuBcMv+A73XAa:JHh6ImzD+Fa
TLSH
T1C9867D41FD8B94B2E9070171489BD3BF5330B9058B21CBD7E7889B6EE933BD11A36256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4984-0-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/4984-7-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/5248-24-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/5248-34-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download