d5f3c2f4168d09761d91edd6fe410e641e3f4ea647bd32f03b048633ac1541b3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_54b8787703141d1d30c13ebb5cf09766_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 13.2MB
Sample260816-jpyqvsshka
SHA256 d5f3c2f4168d09761d91edd6fe410e641e3f4ea647bd32f03b048633ac1541b3
MD5 54b8787703141d1d30c13ebb5cf09766
SHA1 ec757c301d201af58ab212e4866b150e0d8367ad
SHA512 e52f6dae986158c854e6178ab61a5e63c680643e6872c6723bdeae7b8ae6511df509d659ac64f6cb8d59a5a97dd55c27c4b7de311cd331c556d35990a5a5fb88
SSDEEP 98304:gKRuy5aBKRuy5aBKRuy5aBKRuy5aBKRuy5aBKRuy5aBKRuy5aBKRuy5ao/fh6ImA:gqgqgqgqgqgqgqgqJHh6ImzD+FL
TLSH
T168D69D12E6D700F1EA633530456BA37F6A3EB6114735CADBC3440A7A9E23AC15E3536B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
992	svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe
4280	svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe
4140	svchost_ACBCBBBACBACBACBCCCBCACABCCCABBCCAACABAAAACBBACABBACBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCBAACABBCCCCACABCBCBCCBAACBCBCCBCACBBCCCABACCACACBBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe"	2026-08-16_54b8787703141d1d30c13ebb5cf09766_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBABBCBBCAAABACBCCABACACBBCCBBCBACACBACCACABABABAAABABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCBBBACBACBACBCCCBCACABCCCABBCCAACABAAAACBBACABBACBAB.exe"	svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2092	sc.exe
4444	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3952	cmd.exe
3512	cmd.exe
2252	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_54b8787703141d1d30c13ebb5cf09766_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCBBBACBACBACBCCCBCACABCCCABBCCAACABAAAACBBACABBACBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1384	2026-08-16_54b8787703141d1d30c13ebb5cf09766_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1384	2026-08-16_54b8787703141d1d30c13ebb5cf09766_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1384	2026-08-16_54b8787703141d1d30c13ebb5cf09766_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1384	2026-08-16_54b8787703141d1d30c13ebb5cf09766_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
992	svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe
992	svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe
992	svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe
992	svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe
4140	svchost_ACBCBBBACBACBACBCCCBCACABCCCABBCCAACABAAAACBBACABBACBAB.exe
4140	svchost_ACBCBBBACBACBACBCCCBCACABCCCABBCCAACABAAAACBBACABBACBAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	2026-08-16_54b8787703141d1d30c13ebb5cf09766_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	992	svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe
Token: SeDebugPrivilege	4140	svchost_ACBCBBBACBACBACBCCCBCACABCCCABBCCAACABAAAACBBACABBACBAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
640	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 3952	1384	2026-08-16_54b8787703141d1d30c13ebb5cf09766_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	99
PID 3952 wrote to memory of 4108	3952	cmd.exe	101
PID 992 wrote to memory of 4328	992	svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe	102
PID 1384 wrote to memory of 3512	1384	2026-08-16_54b8787703141d1d30c13ebb5cf09766_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	103
PID 3512 wrote to memory of 2092	3512	cmd.exe	105
PID 1384 wrote to memory of 2252	1384	2026-08-16_54b8787703141d1d30c13ebb5cf09766_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	106
PID 2252 wrote to memory of 4444	2252	cmd.exe	108
PID 4328 wrote to memory of 4516	4328	notepad.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-16_54b8787703141d1d30c13ebb5cf09766_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_54b8787703141d1d30c13ebb5cf09766_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAACBCCCACCCBAABACCCCCACBACCBCCBACAABBCBCCCCAACCACBAAAAAAAABBCCCBBCBABBBABABBCBCAAACABCABCBACBBBBBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAACBCCCACCCBAABACCCCCACBACCBCCBACAABBCBCCCCAACCACBAAAAAAAABBCCCBBCBABBBABABBCBCAAACABCABCBACBBBBBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBCACBCBABCCACAABBACACBBCBCBBAAACBBCABCACCCABBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe" start= auto displayName= "UserDataSvc_AABBCACBCBABCCACAABBACACBBCBCBBAAACBBCABCACCCABBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBCACBCBABCCACAABBACACBBCBCBBAAACBBCABCACCCABBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe" start= auto displayName= "UserDataSvc_AABBCACBCBABCCACAABBACACBBCBCBBAAACBBCABCACCCABBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBCACBCBABCCACAABBACACBBCBCBBAAACBBCABCACCCABBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBCACBCBABCCACAABBACACBBCBCBBAAACBBCABCACCCABBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4516

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe
1⤵
- Executes dropped EXE
PID:4280

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBBBACBACBACBCCCBCACABCCCABBCCAACABAAAACBBACABBACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBBBACBACBACBCCCBCACABCCCABBCCAACABAAAACBBACABBACBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 be58eecd99c809ef6852febd5a64eed08d71c7ba2bb31264f62a1c33027bbdb6
MD5 1e6dfff131be9b12ebb62952a088ed51
SHA1 cf94fb4624b3db7e622a70b3c1be130cd46269fb
SHA512 ebb910a80868df7dcee5cf3a7505667ec1f1a79d125d3d33704ca933fea1262b1393026120d40d69c14bb225ca932d3d4295221456a287b4a2e0615dcdf7fe1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9399b9e620ed02adc0c9a93b2437b498c458751d7bdaefba69ec697c1d218c08
MD5 859063ef3711da2346ef898bf1b17f35
SHA1 72777d39da5a4004b04c97a85350d63d952bd780
SHA512 094fe9d7e20f84fa3f0bb30598c1748be2393b326f6e94ad1c8ffe61604bf77b5871412ede246b70441821613fd08dc38e7c4aabc25c8a2d7bf5e63cf38ce9a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1ae5961c0b7e801a37bb460a7512c0b02985b9346f2e0bebc5c92bb4101de410
MD5 57cb60058d3d4afb0e9568870b4b53e5
SHA1 b8b6d9754159cf48c1de537404ac54069b771dbe
SHA512 bf7068551643ceb971e9cc40aa779c61de252d6194b12f02139157250368b3e75809a5c0139dfc17171869153fd4550ac7d61dfa4188b8ef673595c578dcaf5b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7515ac2dbef352200ca3d71d361c57a3da0b9d59e5de0134042d3edf5951a9f9
MD5 bfab47d6d853fa6a26530a9bac434e57
SHA1 c5a2a5db7b9b3a991da0c893cf620162f9db137c
SHA512 69432142595afc30ab2110312fdc0fab97dfefaf0bbb64a4cbd0cebcde2d2473737d6010087f695f0a5af040d37a4fdd915094b4049238fed2467dc4f409ed08
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6178c2a504d4d56a6d1f5487b1d4d45c3fc6e50c10f0cf6d101d1a48ff1a43de
MD5 fd4b0d09c43038169a9d987ce5eb48f9
SHA1 42d7d0a5b32a37122e39f01523942a88775fec89
SHA512 764e289e4780ac1611777807eab322c2b0da72db4570d3ae0d8ee9da4b8c32aee69740eddb2717d66e77c99230de5c6938a348b22df3fa0858b72b48db2c27e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3b42391ed51f61c7dbc788f9ad5fb3bf77167e0f01eb325bca7723dc3631b32a
MD5 4dd352367f2f0385db21d0617acec005
SHA1 62a79cdfab470a1272ae83dd1dc145531d7b36e9
SHA512 ca3aac782fd7776aea3512e4dfce9c4b870cce914e3bf8622916d4a5e514ebbc5bf7e57e18b07c356055ad085877613b42d028d94c3d3c5ca2ee78013b24491d
MD5 SHA1 SHA512

Submit Download

svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCBCBCCCBACBABBAAABCBCABACCCBBCCBCACBACABCAACBBBAB.exe
Size 13.2MB
SHA256 d5f3c2f4168d09761d91edd6fe410e641e3f4ea647bd32f03b048633ac1541b3
MD5 54b8787703141d1d30c13ebb5cf09766
SHA1 ec757c301d201af58ab212e4866b150e0d8367ad
SHA512 e52f6dae986158c854e6178ab61a5e63c680643e6872c6723bdeae7b8ae6511df509d659ac64f6cb8d59a5a97dd55c27c4b7de311cd331c556d35990a5a5fb88
SSDEEP 98304:gKRuy5aBKRuy5aBKRuy5aBKRuy5aBKRuy5aBKRuy5aBKRuy5aBKRuy5ao/fh6ImA:gqgqgqgqgqgqgqgqJHh6ImzD+FL
TLSH
T168D69D12E6D700F1EA633530456BA37F6A3EB6114735CADBC3440A7A9E23AC15E3536B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 ff3cb2d414d9fa57f8f1a08131580e4651627d32a7e5a31c56b5f8b7444b31a4
MD5 6a97feb454d4eedcbad62c669c7898d6
SHA1 db22b19748eab147ea9979ef153d57fe7e772d96
SHA512 de6834b3c3c8f0abf7166c1dce11b77fbf30e1abc836fce04d6ba85f1fa9da237e698c372180e1cbb56545f56213ed19e13bd8f36b63f69d7890a688c7ed6d79
TLSH
T11311C862E4E69D43ED3225CB561E9F920CD5379BED9C7A041388C11EE785C32CE190E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/992-26-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/992-39-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/1384-0-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/1384-7-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/4140-89-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/4280-75-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/4328-67-0x0000000002D10000-0x0000000002D11000-memory.dmp

Download