cac4ea879aec2df8b9a0488b3173c078ac9bb64c814a416ac07ba9610d19bf94

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_5009191d73b9bed2f0ab83c2601c1d61_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 8.7MB
Sample260816-e9ndeadk3t
SHA256 cac4ea879aec2df8b9a0488b3173c078ac9bb64c814a416ac07ba9610d19bf94
MD5 5009191d73b9bed2f0ab83c2601c1d61
SHA1 c711960c39a7b7a6cff2550694f8f1ed400ea6c4
SHA512 4bddcfc9a3fe9a94c134b477076a8327d4e161d58f499e7e01fbeb5e5d421bd0e79084f3e3eef1d3522fb78e6a743e806c05539f537040fb560647130e281ea5
SSDEEP 49152:U+ES+ES+ES+E0+ES+E++ES+ES+ES+E0+ES+E++ES+ES+ES+E0+ES+E++ES+ES+EW:T/fh6ImzzJoDfuBcMv+A73XA1
TLSH
T1E7965B05FD8740F1E91B51B008DBE3BF8630AB1587228EE7EB488F57E923BE15935256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2464	svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe
2008	svchost_BBCCBBACCCBCABBCBAABCABBABAABBBCCACBCCBBBACABCBBCACACBA.exe
1840	svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAAAACBBCABCACBAAACACBBBBAAACAACAABBCACCBACBBACBBBBAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe"	2026-08-16_5009191d73b9bed2f0ab83c2601c1d61_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCACABBBCABBAAAABACAACABBABBCBCBBCABBABABBBBAACBCBBCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCBBACCCBCABBCBAABCABBABAABBBCCACBCCBBBACABCBBCACACBA.exe"	svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5312	sc.exe
2116	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5512	cmd.exe
5916	cmd.exe
5636	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCBBACCCBCABBCBAABCABBABAABBBCCACBCCBBBACABCBBCACACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_5009191d73b9bed2f0ab83c2601c1d61_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4920	2026-08-16_5009191d73b9bed2f0ab83c2601c1d61_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4920	2026-08-16_5009191d73b9bed2f0ab83c2601c1d61_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4920	2026-08-16_5009191d73b9bed2f0ab83c2601c1d61_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
4920	2026-08-16_5009191d73b9bed2f0ab83c2601c1d61_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
2464	svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe
2464	svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe
2464	svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe
2464	svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe
2008	svchost_BBCCBBACCCBCABBCBAABCABBABAABBBCCACBCCBBBACABCBBCACACBA.exe
2008	svchost_BBCCBBACCCBCABBCBAABCABBABAABBBCCACBCCBBBACABCBBCACACBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	2026-08-16_5009191d73b9bed2f0ab83c2601c1d61_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	2464	svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe
Token: SeDebugPrivilege	2008	svchost_BBCCBBACCCBCABBCBAABCABBABAABBBCCACBCCBBBACABCBBCACACBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 5512	4920	2026-08-16_5009191d73b9bed2f0ab83c2601c1d61_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	91
PID 5512 wrote to memory of 2816	5512	cmd.exe	93
PID 2464 wrote to memory of 5924	2464	svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe	94
PID 4920 wrote to memory of 5916	4920	2026-08-16_5009191d73b9bed2f0ab83c2601c1d61_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	97
PID 5916 wrote to memory of 5312	5916	cmd.exe	99
PID 4920 wrote to memory of 5636	4920	2026-08-16_5009191d73b9bed2f0ab83c2601c1d61_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	100
PID 5636 wrote to memory of 2116	5636	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-16_5009191d73b9bed2f0ab83c2601c1d61_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_5009191d73b9bed2f0ab83c2601c1d61_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCCCAACACABBCCCAACBAAABABCBBBBBBCCCABACCBCABCAAABABCBCCABABACCBACCAACCCBCCACBCCBCACBAACCAACBBCABABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCCCAACACABBCCCAACBAAABABCBBBBBBCCCABACCBCABCAAABABCBCCABABACCBACCAACCCBCCACBCCBCACBAACCAACBBCABABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAAACABACCBBCBBAACACBBACABBBCCCBBCCCBBBCBABCAACBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe" start= auto displayName= "UserDataSvc_BBAAACABACCBBCBBAACACBBACABBBCCCBBCCCBBBCBABCAACBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAAACABACCBBCBBAACACBBACABBBCCCBBCCCBBBCBABCAACBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe" start= auto displayName= "UserDataSvc_BBAAACABACCBBCBBAACACBBACABBBCCCBBCCCBBBCBABCAACBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAAACABACCBBCBBAACACBBACABBBCCCBBCCCBBBCBABCAACBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5636
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAAACABACCBBCBBAACACBBACABBBCCCBBCCCBBBCBABCAACBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2116

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBACCCBCABBCBAABCABBABAABBBCCACBCCBBBACABCBBCACACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBACCCBCABBCBAABCABBABAABBBCCACBCCBBBACABCBBCACACBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe
1⤵
- Executes dropped EXE
PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8a7b107fab26cff3104ffada70e059fd3c181e53082b8fe474a5b322c404dc2e
MD5 16f0d1b668234a63f033d90d1e68d126
SHA1 e4e701dfb883e5ed92b4d8980fc8d5b7bb245628
SHA512 1e4b08bad173eb2bddd157217dd78590e20f3d3f303792e52f115605a1742566dc148950de189040e2be458d23a026946cb40e3bdc60cabc4f16bf6344a9078a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cba8228c57ec26cba1827431011db6a6d04669b36ec5bfe824fc7e139d0d4f3b
MD5 2cfa26e02bc09908d2594e730c6a42cb
SHA1 f5a85d79eeac42bc901fc95d3be9a297952b004e
SHA512 4904f6cac1fee74ed8a97d797b053ff80089ba19808c0d0edb76dca6319f841a1681d07d35c79e356d633b903b605507f87fa7709d44ef173dd2c71febaf2235
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a4918202c9bc90f7da4d5803c1ee0213d80f396a8b6e2e794f9ebd4801bb2e13
MD5 cbdc22fa7204f70a0705477d7e00e85c
SHA1 61f3ca4c85a9691812c209edcdf42b168ee479f0
SHA512 436da1d9f11171dd366e6e8859982f6bbb825d5fd3609403868e11b981a7557a6c1e24312ac68877b4fa311a50c9f535d2f126077aa441ad2e47f9fa06210531
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 671e06cecad29d5a12e98ebdd4e1a903896f022d19bf4bf6fb1bb062b2fb182a
MD5 94c12542369ca56d1ca7f68c427b9ab0
SHA1 9a226fbf1d66bcd5485f0390c57648448fddee30
SHA512 b2154314f8a5344646fb020ae66494ea0eb212442a677255344b229848783338e79547982d76b1c6125ae7f5362a5a7a0ed4e34ed67ba065b7d982261766a10c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c1094f8ab9daca0a63ff8c2929454d35fd8e328896535e7f9f852c56559496e0
MD5 ad6558e0652e3c3f5578b58343e28bb1
SHA1 40011c4f98577dcf8bc7c077a7467ae0644081e0
SHA512 3c1ace25a11862069bac31df9acff1d7d76913de5c73155a760079c175f360f29d534671cb9b77c980a1c2041b5c46131a62c61c5e77769114e4c1505a25a9de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 405ae45b9d8a27e0a88626e3baa04297af1dd6d4f4e422c4a50d296590319b42
MD5 438df1648b597c82854c9d1215aa610b
SHA1 b523b5bd27540422af9cb4c4261c935a73e6297d
SHA512 8f00e28f5d34e90eef6070189db2ceebc184751e8572fc70da3a760f0f7e83daf9b67272dbb6bc7e01819aed484f69b4cbfd7ef4c57b6ae2baf66fa7c3f70421
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6f53ba7790e4f6ea5e81d4d3de851606eef8907d7c9b83369498dfec4721971c
MD5 45e8efb8ce9b111576c63177a9c8f357
SHA1 66fdcee33e7a3d51f255f7d0f1644ba056edc822
SHA512 bd37e16617ba89b583a5dffe40e9706c0931c5d6464ed40743bb69a5f9202e6c8edcb7702f883100d6395a28abfc8ec33c0336130674c2ad10520d23fe27a4a1
MD5 SHA1 SHA512

Submit Download

svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACACBABBBACCCBAACAABBBABBCBAABBCCCACCAABBBABCABABACA.exe
Size 8.7MB
SHA256 cac4ea879aec2df8b9a0488b3173c078ac9bb64c814a416ac07ba9610d19bf94
MD5 5009191d73b9bed2f0ab83c2601c1d61
SHA1 c711960c39a7b7a6cff2550694f8f1ed400ea6c4
SHA512 4bddcfc9a3fe9a94c134b477076a8327d4e161d58f499e7e01fbeb5e5d421bd0e79084f3e3eef1d3522fb78e6a743e806c05539f537040fb560647130e281ea5
SSDEEP 49152:U+ES+ES+ES+E0+ES+E++ES+ES+ES+E0+ES+E++ES+ES+ES+E0+ES+E++ES+ES+EW:T/fh6ImzzJoDfuBcMv+A73XA1
TLSH
T1E7965B05FD8740F1E91B51B008DBE3BF8630AB1587228EE7EB488F57E923BE15935256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 0e290fbfbdff419e2dbebfc3b09fadbcb3732d9f9310ccb4cb53ebfca79e72e8
MD5 8d94a5b3686bd977caff6e3c7326c1c3
SHA1 6b6a9d6c7bb7cc45ada68dfffaf24f1e82ee27aa
SHA512 3f5ca6a1101e498631662dd0d3a5a4d30fdcbc4684697be9227cde09e16ad3a186db7c451614814d1139b35357e7a14306bdbc38640dde915082a25aa57d25a3
TLSH
T1C5110401E8E5CC93DA3274C7A72D8F820CB6739BA89C6EA423094118FB99D355D598E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2008-74-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/2464-34-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/4920-0-0x0000000000390000-0x00000000003B1000-memory.dmp

Download

memory/4920-8-0x0000000000390000-0x00000000003B1000-memory.dmp

Download