7db091551e4c716091ba033ff7fdf9723eeaf1bce145ebb415c1aaabffe6779b

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_65192ca91509c349743dc3b44f1e5a79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 6.2MB
Sample260816-e2dh8szbre
SHA256 7db091551e4c716091ba033ff7fdf9723eeaf1bce145ebb415c1aaabffe6779b
MD5 65192ca91509c349743dc3b44f1e5a79
SHA1 291f4834d80833ea856437a587646d9ef612330e
SHA512 c79913aec9137c5644b009e19c87829eb3b1b5c0f7b60102a4b61c396e13d3304bb13cb5bc01a261d39728781fb6e7127b5732e5d4241b18ba927a0a92bcd780
SSDEEP 98304:gMMMMMMMN/fh6ImzzJoDfuBcMv+A73XAi:RHh6ImzD+Fi
TLSH
T1D8666C81FA8B85F2E5030231489B93BF5730B9058B26DBD7D744AB6EE9337D11A33256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4904	svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe
5828	svchost_CCBBCCAABACABAACBCABBCCACBAACBCBAACCBCACCBCCCCCBBACACAC.exe
2432	svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABCBAACABCBBCCAAACCAACCACCCCACACCBBCBACACBBBABAACCCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe"	2026-08-16_65192ca91509c349743dc3b44f1e5a79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCBCCCBBCCBABBCABACBCABBCBAAACACBACBCCBCCCACACCBACCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBCCAABACABAACBCABBCCACBAACBCBAACCBCACCBCCCCCBBACACAC.exe"	svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
700	sc.exe
3132	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5456	cmd.exe
1156	cmd.exe
1076	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_65192ca91509c349743dc3b44f1e5a79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBCCAABACABAACBCABBCCACBAACBCBAACCBCACCBCCCCCBBACACAC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2440	2026-08-16_65192ca91509c349743dc3b44f1e5a79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2440	2026-08-16_65192ca91509c349743dc3b44f1e5a79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2440	2026-08-16_65192ca91509c349743dc3b44f1e5a79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2440	2026-08-16_65192ca91509c349743dc3b44f1e5a79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4904	svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe
4904	svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe
4904	svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe
4904	svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe
5828	svchost_CCBBCCAABACABAACBCABBCCACBAACBCBAACCBCACCBCCCCCBBACACAC.exe
5828	svchost_CCBBCCAABACABAACBCABBCCACBAACBCBAACCBCACCBCCCCCBBACACAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2440	2026-08-16_65192ca91509c349743dc3b44f1e5a79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	4904	svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe
Token: SeDebugPrivilege	5828	svchost_CCBBCCAABACABAACBCABBCCACBAACBCBAACCBCACCBCCCCCBBACACAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 5456	2440	2026-08-16_65192ca91509c349743dc3b44f1e5a79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	92
PID 5456 wrote to memory of 3336	5456	cmd.exe	94
PID 4904 wrote to memory of 4856	4904	svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe	95
PID 2440 wrote to memory of 1156	2440	2026-08-16_65192ca91509c349743dc3b44f1e5a79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	98
PID 1156 wrote to memory of 3132	1156	cmd.exe	100
PID 2440 wrote to memory of 1076	2440	2026-08-16_65192ca91509c349743dc3b44f1e5a79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	101
PID 1076 wrote to memory of 700	1076	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_65192ca91509c349743dc3b44f1e5a79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_65192ca91509c349743dc3b44f1e5a79_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAACACBBACAABAACCCCCABCABBBBAAAABABCBBABBCAABAACBABCAABCCACCCCBBBCAACCABCBBBBAABABAABAABAABABCBCBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAACACBBACAABAACCCCCABCABBBBAAAABABCBBABBCAABAACBABCAABCCACCCCBBBCAACCABCBBBBAABABAABAABAABABCBCBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBAABBBBACABBACBABCBACCBCCCCCABACBBCBABBAABAAABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe" start= auto displayName= "UserDataSvc_BCBAABBBBACABBACBABCBACCBCCCCCABACBBCBABBAABAAABCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBAABBBBACABBACBABCBACCBCCCCCABACBBCBABBAABAAABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe" start= auto displayName= "UserDataSvc_BCBAABBBBACABBACBABCBACCBCCCCCABACBBCBABBAABAAABCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBAABBBBACABBACBABCBACCBCCCCCABACBBCBABBAABAAABCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBAABBBBACABBACBABCBACCBCCCCCABACBBCBABBAABAAABCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCAABACABAACBCABBCCACBAACBCBAACCBCACCBCCCCCBBACACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCAABACABAACBCABBCCACBAACBCBAACCBCACCBCCCCCBBACACAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe
1⤵
- Executes dropped EXE
PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 928a68933442bca3abf03fd8b6c0ef8b11d83eeddbd25f481e1ce1d4f3d6ce7d
MD5 3ab40822bb42d2033f56e580c57ba211
SHA1 b842ad628228f9aaa1122cd09e0d41e34b0d8973
SHA512 9c2b4b5e3665e35a03b906eab8b1717f6506ef2ec1166b4da4302d5dee22105a76b7c893c71fa076d2ab30b026e35ebab06f678a09a07ab0a72ab91f17c37878
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d14bdebecb0514fe884a8d6c25919d68cf8bed793ebd0a92f61e42e167ed5a00
MD5 54c081601dc958a71b1efa2a3899ea29
SHA1 4231d4cc25d8d0e083596fc0498bdf6be32101d6
SHA512 8b13c9f4e36e085226a779c8a44769d23c177dffe167d315c00a2b0bdceaf8a5e5052898976b66cbfb6041ff71c811e1a1b759cf0d7152f91bf44d9dd15a9082
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 172d0834a064a6bd1d5027163e5565ca26e9d96d2a71ee112d0031fd3189fe98
MD5 78e9a25fe58bac83db8eff47513426cb
SHA1 4e301509dd59699411008b291571887d1e7eea6a
SHA512 1728231486afc5a0d8dc96b43979f05004ac2c075fd9607d48c1c65f4f55bf93b3169a8e819b9f88914b63da2f695e815a14d256a713a57489e73f4cf0f48515
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eda2edb3425f174be3dc95682e5852e28035885bd356a064f06f81dfc9789b11
MD5 0f777dc046ba6911403ec83004b7e1c6
SHA1 c2fae93543d250fc5af064283ed7e5ca760d8b83
SHA512 7316953e096400f5814fd1e7d52bde17877debc3ebf0e68525eb600c1ea160ebd72ccdfea53f6236d053e740ab1265da68b80b444f3d55fc8614d0b6a6495570
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2952ce3adc990cad6191da3e0cdf69c14d7df6568fad753d076fa16e0a111b74
MD5 08b84c00ba0634f8f1c9c72bf455453d
SHA1 a3db7b6b6b03b614cb576a91d5cb07e122452262
SHA512 a7d61c8a6f386116243648ce537b15cd7035e8f14e6006c55ee00b85799b42699b49e3b719c0ba6cf18267c3940f5b81d593449cd08726162d18a7d848d24d3c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ceba080a168e9eb0ce68b3508c62bea92c77a65a3cd027d301512294d7e8d28b
MD5 c1400bde478d0c44d8e8124901b18882
SHA1 d0cbfe4155830f97a9dda5490af8788424b9cb50
SHA512 2bf203dc643b640609d69f8bd96c443cbe25ea0da767c62c51154708ced8538cf845b56dfd9f4565999886f7bd85d548a6ba7f208db8cf51b9f843dd133973d4
MD5 SHA1 SHA512

Submit Download

svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBACCBBCCBBAAABBCCCCBABBBAACACACBBBCABABCACABAABCACBB.exe
Size 6.2MB
SHA256 7db091551e4c716091ba033ff7fdf9723eeaf1bce145ebb415c1aaabffe6779b
MD5 65192ca91509c349743dc3b44f1e5a79
SHA1 291f4834d80833ea856437a587646d9ef612330e
SHA512 c79913aec9137c5644b009e19c87829eb3b1b5c0f7b60102a4b61c396e13d3304bb13cb5bc01a261d39728781fb6e7127b5732e5d4241b18ba927a0a92bcd780
SSDEEP 98304:gMMMMMMMN/fh6ImzzJoDfuBcMv+A73XAi:RHh6ImzD+Fi
TLSH
T1D8666C81FA8B85F2E5030231489B93BF5730B9058B26DBD7D744AB6EE9337D11A33256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 100f6075054d749a8e89b03f20d90ee6d32ddc96ef94cc34331198e4b8c37f46
MD5 38c22a902711d95e6f1e566a4b66a125
SHA1 b9a9dcd0c999428161e0efbdadcb9cf59243491b
SHA512 f8e5b987b53473d3c9a10ca457cc9364fd27aa4b8c722dfcaede2ceb656b8f6e2cebba3790e470632400dd7c8787293a7528af226438e204cbaff71806ef45ec
TLSH
T15111A750B8E6E823FD3374CF6A3D8F5318D5379B58946A9423084318FB95E329D594F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2440-7-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/2440-0-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4904-33-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/4904-23-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/5828-70-0x0000000000880000-0x00000000008A1000-memory.dmp

Download