66cbf66e098bafda45034f378a2f29dbfa75f3d41de61786a89df12452bee5c3

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_5d28f083cb8095cd93baeb89ce49b8c2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 8.3MB
Sample260814-ey7mxafb79
SHA256 66cbf66e098bafda45034f378a2f29dbfa75f3d41de61786a89df12452bee5c3
MD5 5d28f083cb8095cd93baeb89ce49b8c2
SHA1 77c5ab57b5a67b29fd7093ccee43cf9368ab2a9c
SHA512 1e2ae194c0238ec3f5b77a665beadc5e2503775ae00ba6797af3a20e1fe1acaf064526253bbdcae437e18ccf155458e37b8632df5ace7aedb9aba1d782a202b3
SSDEEP 98304:y5n5n5n5n5n5n5n5n52/fh6ImzzJoDfuBcMv+A73XAM:y5n5n5n5n5n5n5n5n52Hh6ImzD+FM
TLSH
T1E8965C58FBEB11B1FA735A708876C2BB6E317D104730C7EFD640BA19AD229D09836716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3384	svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe
1568	svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe
3512	svchost_ABCACAAAABBCCABACCBCABCBCABBBACCBAAABAABAACAACACBBAACCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBCBCCBABCCBBACABAABACABCBBCAAABACACACABAAACCCACBCABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe"	2026-08-14_5d28f083cb8095cd93baeb89ce49b8c2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACCCBCABCACACCCCACACBCAACCBBAAACACBACAABBACBBABABABAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCACAAAABBCCABACCBCABCBCABBBACCBAAABAABAACAACACBBAACCC.exe"	svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2488	sc.exe
6072	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2408	cmd.exe
4048	cmd.exe
5996	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_5d28f083cb8095cd93baeb89ce49b8c2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4836	2026-08-14_5d28f083cb8095cd93baeb89ce49b8c2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4836	2026-08-14_5d28f083cb8095cd93baeb89ce49b8c2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4836	2026-08-14_5d28f083cb8095cd93baeb89ce49b8c2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4836	2026-08-14_5d28f083cb8095cd93baeb89ce49b8c2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3384	svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe
3384	svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe
3384	svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe
3384	svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	2026-08-14_5d28f083cb8095cd93baeb89ce49b8c2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	3384	svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 2408	4836	2026-08-14_5d28f083cb8095cd93baeb89ce49b8c2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	95
PID 2408 wrote to memory of 5776	2408	cmd.exe	97
PID 3384 wrote to memory of 1092	3384	svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe	100
PID 4836 wrote to memory of 4048	4836	2026-08-14_5d28f083cb8095cd93baeb89ce49b8c2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	101
PID 4048 wrote to memory of 2488	4048	cmd.exe	103
PID 4836 wrote to memory of 5996	4836	2026-08-14_5d28f083cb8095cd93baeb89ce49b8c2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	104
PID 5996 wrote to memory of 6072	5996	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-14_5d28f083cb8095cd93baeb89ce49b8c2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_5d28f083cb8095cd93baeb89ce49b8c2_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBACABCACCAAABAACCBCCCABACABABACBBBCBCBAACAABCACACCABBCCABACBCAAAAACAABACBABABBCAAABCCACBACCBBBABBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBACABCACCAAABAACCBCCCABACABABACBBBCBCBAACAABCACACCABBCCABACBCAAAAACAABACBABABBCAAABCCACBACCBBBABBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCBBCBABABAABCCAAAACCBCAACACBBCCAACCABCCCAAAABCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe" start= auto displayName= "UserDataSvc_CCBCBBCBABABAABCCAAAACCBCAACACBBCCAACCABCCCAAAABCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCBBCBABABAABCCAAAACCBCAACACBBCCAACCABCCCAAAABCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe" start= auto displayName= "UserDataSvc_CCBCBBCBABABAABCCAAAACCBCAACACBBCCAACCABCCCAAAABCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCBBCBABABAABCCAAAACCBCAACACBBCCAACCABCCCAAAABCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCBBCBABABAABCCAAAACCBCAACACBBCCAACCABCCCAAAABCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6072

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe
1⤵
- Executes dropped EXE
PID:1568

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACAAAABBCCABACCBCABCBCABBBACCBAAABAABAACAACACBBAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACAAAABBCCABACCBCABCBCABBBACCBAAABAABAACAACACBBAACCC.exe
1⤵
- Executes dropped EXE
PID:3512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SwitchDisable.exe

Path C:\Users\Admin\Desktop\SwitchDisable.exe
Size 25.7MB
SHA256 44dd134400e6a3ce7c4812817425fe1b997466df7ad7ff2e47ec723b6d6beaa8
MD5 6e5b5acf702a938b8584308dc4c0692b
SHA1 1888dce4e7297a6ba848524813af1255c70423b4
SHA512 66d2cb25e3fa3886b8aa9f0ef607ec76352441f5b1154d468cda97a53be35d661db69cce6205b49f26ad27fe41dc38e8888389ae1a2b7fa28a5d2489d3c32a33
SSDEEP 786432:y5n5n5n5n5n5n5n5n5N65n5n5n5n5n5n5n5n5N65n5n5n5n5n5n5n5n5NM:EMMM
TLSH
T148475C58FBEB11B1FA735A708876C2BB6E317D104730C7EFD640BA19AD229D09836716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchDisable.exe

Path C:\Users\Admin\Desktop\SwitchDisable.exe
Size 2.1MB
SHA256 ba135b27e984c4f50c98eb72fe0fc917ea4d304dff37bda6d86e5bc085938daa
MD5 0ab2653809d58f683bc4ff27484b54d7
SHA1 b47278429f2939c32be00ce812bca5862b2a1cd7
SHA512 17060570c4871a1129d8a1f20f507418bbfe51e3be36a4e3c1fc24f2a4313600470b70e016aa4baa0501d9449ef477c79b5d9129c85e3f8dc673842d43d75612
SSDEEP 49152:U+EyC5zP+EyC5zP+EyC5zP+EyC5zP+Eyb:y5n5n5n54
TLSH
T13BA52A1C77FA2251FAB39AB488B5C2B66D317D20473097EF5640F62D1E329D0E839B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 13cc0955925a488f375e16516367fea1a1bddfeec8ba501f1828201afa5417a8
MD5 42f95e55b1426293ce82f0d4ab6fd27a
SHA1 3fc5688bc5aa9b28b5b685b682b39b1b26b1bb7d
SHA512 321d7ff20ebe4f02b833126a3e41855c5dd54e1237919afc96fd6a91e21c68d8db642dd3b0b4702035c508bad7db3efd9d58533a76a7945d90279406cb5de613
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 641968d415500fe3c2832e342ac375742eafb967698d10b3b9e6baa1a80f67e1
MD5 f8a8199a84fcab63f6d9dbace6af83b7
SHA1 277976ec774efa480669e524b2ac9b87fb89bc24
SHA512 07f3c3007813d459c93840a50509db00a9bdca51e07a970eb085ffd998f6338aa6f762f8bf0011afff53f6a67945067d25d825ec1dfc69211f54352f5deb211f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 62bb6c6f6fe7d50479be450f14e67d40edba2aceb0052f206a491ce56c5e5a66
MD5 783b6c03761d6eb985566daaad80e39e
SHA1 8aa4b7fc1fb16adf515e79d96984d3f5a291c76a
SHA512 c99c1bce4371d12de22ed083fbfbb85b489f163078c6086f9872c424ab1bc21ab11199752cbb58825a19cc507be04d3997845c21c91c28436fce935fa2ea363a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7de79b41a6472a63780a05384c2af0d7281cf95da9519af9fd8bca98b56568d2
MD5 5e5d2fdaa187a8625c745fde26b85a57
SHA1 ee6af50b349c0d934e4f245e3bfd63089a2f7777
SHA512 9c6d4b33e579be070b2631cbd2f522116009af4349d58894236f79fac93e190c0e205fc111d804864ed4463256caad2a37bdfb30a28225e89e21883005b12ccf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 55ec61d0699183ae400593d49ec3c27b2cf5edcfb968ecebbccbb71e4f926c4d
MD5 955c67d884ec30171836017e1c1d3860
SHA1 1a683fb62f1dde6e151ba57a97371c46da7ef7ff
SHA512 39d11749f1605f163753b2e47dd384f367810006be28658373657a3be85b6e86e1a38608cc49d47de58f0fcde073f3752ab40f712bd2b0bee879b5373377d3bc
MD5 SHA1 SHA512

Submit Download

svchost_ABCACAAAABBCCABACCBCABCBCABBBACCBAAABAABAACAACACBBAACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACAAAABBCCABACCBCABCBCABBBACCBAAABAABAACAACACBBAACCC.exe
Size 3.2MB
SHA256 2616df3ad9fb415b834ef992884694fd2050d5dce294ab00eab163de1b015762
MD5 04ac73e47bade45b164350c815f6b9fa
SHA1 91c4cfe7aa4529dbebd4c8ae116ae4b6c59072b8
SHA512 79b704fd56d45ffaaf6311c1742911094c74276da97d3332a6920502e8c8dd76fb40c4ebac5ce963eb4f3d830c77a6b8dcb67a4ab594584a575fd5e7514c80cd
SSDEEP 49152:U+EyC5zP+EyC5zP+EyC5zP+EyC5zP+EyC5zP+EyC5zP+EyC5x:y5n5n5n5n5n5n5x
TLSH
T195F5095C77FA1245FAB39AB498B5C2E26D317D20473097EF5600F62D1E329D0E839B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBCBCAACBCCAAACCABBCCBBACCCCACABCABCBCBBBBACAACACA.exe
Size 8.3MB
SHA256 66cbf66e098bafda45034f378a2f29dbfa75f3d41de61786a89df12452bee5c3
MD5 5d28f083cb8095cd93baeb89ce49b8c2
SHA1 77c5ab57b5a67b29fd7093ccee43cf9368ab2a9c
SHA512 1e2ae194c0238ec3f5b77a665beadc5e2503775ae00ba6797af3a20e1fe1acaf064526253bbdcae437e18ccf155458e37b8632df5ace7aedb9aba1d782a202b3
SSDEEP 98304:y5n5n5n5n5n5n5n5n52/fh6ImzzJoDfuBcMv+A73XAM:y5n5n5n5n5n5n5n5n52Hh6ImzD+FM
TLSH
T1E8965C58FBEB11B1FA735A708876C2BB6E317D104730C7EFD640BA19AD229D09836716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3384-34-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/3384-49-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/3384-71-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/4836-35-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/4836-23-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/4836-12-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/4836-61-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/4836-0-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download