3085542d9396d4eb95fdd7d7f59869a379589ec4acfbb5ea2b4f0e4d24b09563

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_38e7f699f0ea1bbfd9dbc23b1e90f698_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 12.0MB
Sample260814-fdlelsvxdt
SHA256 3085542d9396d4eb95fdd7d7f59869a379589ec4acfbb5ea2b4f0e4d24b09563
MD5 38e7f699f0ea1bbfd9dbc23b1e90f698
SHA1 319b88f8001d0ee19682d3934f94e8ccd872b1ae
SHA512 ade1f5588ff6e3590329ae9ba71e5e1d4b3a05fe9440fa975914278c1904accbf49e7c751cff49543ba9bbe37c658688b0c02abe7421f0e1e1049f918722465c
SSDEEP 98304:yq5hq5hq5hq5hq5hq5hq5hq5hq5Y/fh6ImzzJoDfuBcMv+A73XA3:x50505050505050505YHh6ImzD+F3
TLSH
T179C65B45FBD741B1E963467048ABC2BB6E30B9104B31CBDFE744A71EAD236D0A936316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3712	svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe
3084	svchost_ACABCCCCCBBBBCBCCCACAAABACBBCACCABCBBBBCACCCABABABCBBBA.exe
2016	svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBABBAACACCCAACCACAACACBCBACAACCCABBCCACACABCCABABBBCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe"	2026-08-14_38e7f699f0ea1bbfd9dbc23b1e90f698_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBACBABCABBACCACBABABCACCAACCBBACBCABACBCCCCCAAABCBBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABCCCCCBBBBCBCCCACAAABACBBCACCABCBBBBCACCCABABABCBBBA.exe"	svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1920	sc.exe
1728	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1156	cmd.exe
5960	cmd.exe
5348	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABCCCCCBBBBCBCCCACAAABACBBCACCABCBBBBCACCCABABABCBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_38e7f699f0ea1bbfd9dbc23b1e90f698_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3100	2026-08-14_38e7f699f0ea1bbfd9dbc23b1e90f698_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3100	2026-08-14_38e7f699f0ea1bbfd9dbc23b1e90f698_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3100	2026-08-14_38e7f699f0ea1bbfd9dbc23b1e90f698_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3100	2026-08-14_38e7f699f0ea1bbfd9dbc23b1e90f698_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3712	svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe
3712	svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe
3712	svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe
3712	svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe
3084	svchost_ACABCCCCCBBBBCBCCCACAAABACBBCACCABCBBBBCACCCABABABCBBBA.exe
3084	svchost_ACABCCCCCBBBBCBCCCACAAABACBBCACCABCBBBBCACCCABABABCBBBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	2026-08-14_38e7f699f0ea1bbfd9dbc23b1e90f698_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	3712	svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe
Token: SeDebugPrivilege	3084	svchost_ACABCCCCCBBBBCBCCCACAAABACBBCACCABCBBBBCACCCABABABCBBBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 5348	3100	2026-08-14_38e7f699f0ea1bbfd9dbc23b1e90f698_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	92
PID 5348 wrote to memory of 1452	5348	cmd.exe	94
PID 3712 wrote to memory of 2056	3712	svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe	95
PID 3100 wrote to memory of 1156	3100	2026-08-14_38e7f699f0ea1bbfd9dbc23b1e90f698_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	98
PID 1156 wrote to memory of 1920	1156	cmd.exe	100
PID 3100 wrote to memory of 5960	3100	2026-08-14_38e7f699f0ea1bbfd9dbc23b1e90f698_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	101
PID 5960 wrote to memory of 1728	5960	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_38e7f699f0ea1bbfd9dbc23b1e90f698_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_38e7f699f0ea1bbfd9dbc23b1e90f698_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCBCCACAABAACCCBCBBCBBABABABCACBCAABBBAABBCABBBACAABCCAAAABCCBCBCCCCBBABCAAABCCCCCABCBAACCBCBBAAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCBCCACAABAACCCBCBBCBBABABABCACBCAABBBAABBCABBBACAABCCAAAABCCBCBCCCCBBABCAAABCCCCCABCBAACCBCBBAAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCBBCBBAAAAACCBABCAACACCABAACBCCCCACBBACBCABCCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe" start= auto displayName= "UserDataSvc_CCCCBBCBBAAAAACCBABCAACACCABAACBCCCCACBBACBCABCCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCBBCBBAAAAACCBABCAACACCABAACBCCCCACBBACBCABCCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe" start= auto displayName= "UserDataSvc_CCCCBBCBBAAAAACCBABCAACACCABAACBCCCCACBBACBCABCCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCBBCBBAAAAACCBABCAACACCABAACBCCCCACBBACBCABCCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5960
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCBBCBBAAAAACCBABCAACACCABAACBCCCCACBBACBCABCCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1728

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCCCCBBBBCBCCCACAAABACBBCACCABCBBBBCACCCABABABCBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCCCCBBBBCBCCCACAAABACBBCACCABCBBBBCACCCABABABCBBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe
1⤵
- Executes dropped EXE
PID:2016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d1b3f2fd4d2397d6790b01292233e77373ee19a075c97cd1fffc598fc4ad7abd
MD5 fdfea412a5379112a153bba1f5ca9224
SHA1 72356ccd402eba30dd7d2e8c6e4f0aedf79af95c
SHA512 55b319f2f62e4734e05d7fb88dccece544f18dd041a2768a7006bd24204997b91bf05b0e89316c02f632e92340da2190a18181807b5cf519781b3e16cd9aed02
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a73ed9f6a53ceaf169705d7e4072bd35a399c3515288a24640de0403768d8fbe
MD5 e2579fe988772e654630f922fae9e86a
SHA1 8a24004e5732561d7f878cfa4c209dde457da071
SHA512 070f2e24bee06b99aeb942d7d412bcbd081464aac3f35696ae8ba57442f8e289f6627ddcbc037cbf0c992ccc420f39d65fc65c18c99a81236dc97bc7e2495bde
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cddb1132148e49edd788025867e5f2263d1f7248a9cdab882f379fbf50fe807f
MD5 20ce521cba8e42e6b03740b1d07c1ec2
SHA1 a3b014fff2f028e110a9d5d269aa327327bc97c1
SHA512 5cf5db9173d42a17c790e24e80f405938a693d02fa949ea3db5fa295286e368da6ea7bd88b2479a32535e3e2e9a291af0c9bda55a52b1462ff1dc926a6b86f44
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e4906553445f7318f8f22d2479fae1ff62ab27efff8267a4e28e85d88f117d6c
MD5 49f667bee220cdd00fd5ce0902dcad0b
SHA1 cd5f75dcbca7a27d70af79f08a2fcb1b013c1b1c
SHA512 f5a9b7ca9f5b6dbd2508f0d01b530698d81dbc1848ffa83be5e6e1ca5fbf08d56bf6c2ea96559d2c9bb7c131fa69b540bf04679925255f47234a29dce14adbac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dd5232d79fa87793ab246a25cb131f96f025c8a195b488eb7a4a8da569fb00af
MD5 16393add18a162cb4e9f6a1598760345
SHA1 8fa18ca4c822999539e43a85293a8bc7a9660073
SHA512 774fbb742058204368e7dfddb4ad8b84cae30c79f6aab9ada42adf4e89688fcc2b3e75d435b8c1b2ba53fd2daf5675f17bf3ce420d80ec6f63ef7af77fc6b74c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2beec82d6fcb4c8795067ee953bd6deabb136117f4bbbc9847ffd0529955341e
MD5 61f1bebba8da71c6f9db5a7c6a44bc77
SHA1 920d21b6c39dafd3607970a82608468769f6b2ff
SHA512 1ddb23b88a4472519755d6183c3d2870951025c8838bc580b2fa48af6dd3740dbdfc099a5cff08158dbb6da765c2029b763c9d7052cf29f834cb7cb4c73a8a08
MD5 SHA1 SHA512

Submit Download

svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBACBBBBCAACACCBABAACACCAABCCBCBCBCBCAACCABBACCBCB.exe
Size 12.0MB
SHA256 3085542d9396d4eb95fdd7d7f59869a379589ec4acfbb5ea2b4f0e4d24b09563
MD5 38e7f699f0ea1bbfd9dbc23b1e90f698
SHA1 319b88f8001d0ee19682d3934f94e8ccd872b1ae
SHA512 ade1f5588ff6e3590329ae9ba71e5e1d4b3a05fe9440fa975914278c1904accbf49e7c751cff49543ba9bbe37c658688b0c02abe7421f0e1e1049f918722465c
SSDEEP 98304:yq5hq5hq5hq5hq5hq5hq5hq5hq5Y/fh6ImzzJoDfuBcMv+A73XA3:x50505050505050505YHh6ImzD+F3
TLSH
T179C65B45FBD741B1E963467048ABC2BB6E30B9104B31CBDFE744A71EAD236D0A936316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 902a1291aa6fb869f79128163eb5b558d32b2ee4ffbe487618834beda5527311
MD5 247a4b44b1c582fcaf497490601dcab7
SHA1 8007fad8fd7937409d711d10d5b89e3efda49215
SHA512 a29c064f3ec735f4b7bcd2945ddec1863634f3a6069f55e956563d1edc766a9e826d34f5eed2f9264649620b798191a8945ddd1739e43ff7a3279d4f94b30e68
TLSH
T12111CB60ACE5D823DD32B4CF422DCBE20CFC77679C586A541209422D7B85E32CE658D5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3084-79-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/3100-0-0x00000000006E0000-0x0000000000701000-memory.dmp

Download

memory/3100-7-0x00000000006E0000-0x0000000000701000-memory.dmp

Download

memory/3712-23-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download

memory/3712-33-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download