6287751cf7c6eb9046a477058e36acdf9c04f93b9ded5d8fb8f78628b3ddd0c9

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_05692e667e7ed67985871dfd524fd7ca_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 12.2MB
Sample260818-ebe95sdp5y
SHA256 6287751cf7c6eb9046a477058e36acdf9c04f93b9ded5d8fb8f78628b3ddd0c9
MD5 05692e667e7ed67985871dfd524fd7ca
SHA1 ef82e791b2eef00180d851685f35cf4b43067400
SHA512 e46df776d05c01fd0689a0afef2b18f3cd840ccc50ee23af2d14fe4dfc3710504d8bc0b7a0aa3eed3d11aacc5d6ce8d16b6f04b415b2b0ec954e49b323fa8842
SSDEEP 98304:fccccccccq/fh6ImzzJoDfuBcMv+A73XA8:KHh6ImzD+F8
TLSH
T149D67C42FAC744B1E913017148AB92BF5231BD114F32CBD7E784AB6EE933BD15A32256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6212	svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe
4940	svchost_CCBAACACAABCAABABBCACBCABABBABBCCCACAAACACBAAAAABBBCACB.exe
4604	svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACCCABABBBAAAAAAACACCAACBCAABABABAAACCCCACCBCBBBAABCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAACACAABCAABABBCACBCABABBABBCCCACAAACACBAAAAABBBCACB.exe"	svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCACCBCACAACBCBBACCCCACBAACCAABABBAAAABBAABCCCBCBCCACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe"	2026-08-17_05692e667e7ed67985871dfd524fd7ca_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2096	sc.exe
6224	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
704	cmd.exe
1484	cmd.exe
1116	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_05692e667e7ed67985871dfd524fd7ca_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBAACACAABCAABABBCACBCABABBABBCCCACAAACACBAAAAABBBCACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1300	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4288	2026-08-17_05692e667e7ed67985871dfd524fd7ca_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4288	2026-08-17_05692e667e7ed67985871dfd524fd7ca_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4288	2026-08-17_05692e667e7ed67985871dfd524fd7ca_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4288	2026-08-17_05692e667e7ed67985871dfd524fd7ca_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
6212	svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe
6212	svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe
6212	svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe
6212	svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe
4940	svchost_CCBAACACAABCAABABBCACBCABABBABBCCCACAAACACBAAAAABBBCACB.exe
4940	svchost_CCBAACACAABCAABABBCACBCABABBABBCCCACAAACACBAAAAABBBCACB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4288	2026-08-17_05692e667e7ed67985871dfd524fd7ca_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	6212	svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe
Token: SeDebugPrivilege	4940	svchost_CCBAACACAABCAABABBCACBCABABBABBCCCACAAACACBAAAAABBBCACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 704	4288	2026-08-17_05692e667e7ed67985871dfd524fd7ca_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	93
PID 704 wrote to memory of 1300	704	cmd.exe	95
PID 6212 wrote to memory of 4368	6212	svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe	96
PID 4288 wrote to memory of 1484	4288	2026-08-17_05692e667e7ed67985871dfd524fd7ca_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	99
PID 1484 wrote to memory of 6224	1484	cmd.exe	101
PID 4288 wrote to memory of 1116	4288	2026-08-17_05692e667e7ed67985871dfd524fd7ca_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	102
PID 1116 wrote to memory of 2096	1116	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-17_05692e667e7ed67985871dfd524fd7ca_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_05692e667e7ed67985871dfd524fd7ca_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACACCCBCABBAACBAABCBCCBCCCABBCABBCBCBCACBBAABBAAAABCABCCCACAACBBABACACACBCABCBACBAAABCBABABACBBCBAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACACCCBCABBAACBAABCBCCBCCCABBCABBCBCBCACBBAABBAAAABCABCCCACAACBBABACACACBCABCBACBAAABCBABABACBBCBAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCAAAABABACAAACCACCABABCCABACCCCABAABCCBBACBABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe" start= auto displayName= "UserDataSvc_BBBCAAAABABACAAACCACCABABCCABACCCCABAABCCBBACBABAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCAAAABABACAAACCACCABABCCABACCCCABAABCCBBACBABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe" start= auto displayName= "UserDataSvc_BBBCAAAABABACAAACCACCABABCCABACCCCABAABCCBBACBABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCAAAABABACAAACCACCABABCCABACCCCABAABCCBBACBABAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCAAAABABACAAACCACCABABCCABACCCCABAABCCBBACBABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2096

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6212
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4368

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACACAABCAABABBCACBCABABBABBCCCACAAACACBAAAAABBBCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACACAABCAABABBCACBCABABBABBCCCACAAACACBAAAAABBBCACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe
1⤵
- Executes dropped EXE
PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2c86f91d9454bac1b308b1af0ce5fccd23ca8d531b691753f0eb91bd8810e012
MD5 f04bf998328b07ada0dac16154dfb6c3
SHA1 e4cd1026e2063f6ab055dbf0cc4342fa98e41f54
SHA512 8f997eb3e874c0a7301f65080b139de8a0267a7dc52a3d0e6e9e026934cdb414b8d01755946ea0103ffec1e25cfca0b0c5bb0880ee0b67b1f2da34a5acb38e76
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b295f8a656e606d173560356a668f9d730e2e24c2e1213b5cb2971b4c4db9846
MD5 c5d05bf0097a43672270392dd291f258
SHA1 dba5455481fd435ce3dbe9d2b9a8b37a4426c483
SHA512 686fd9ea16c6a075fe93ad1043ee64c521bc3ae126bce7af99de547e97a1377f40ee1fed0134cd052158e9048af67f8d73ebf8c02dde364f577b963c0799ff8e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 231f118972a6eee6a39f50971c715cff68360b43d96a9dd987bfeb0651ac89f1
MD5 78e61b32e1efc1f5d60395e5f8727f10
SHA1 9d18445a737e36e8b93e5f4a56a1aa67384bc934
SHA512 f844ecfce268ea4b1ed9ad7f79b50fa9b39e914a72c9cf2ed40ea2574896f2b8ac14367ab3e8492093ea4a59a2868f5939bfc6bf88f649fd22707a740683644a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ee4dee223d94e29545d0db06c5267120f9e2a133d06d5f9bf1d072f56ffbe4a1
MD5 897c1de264523bfabd2aed5718bcf089
SHA1 05f5a68b5dbafe94f29e0dcd40062cf4fe795555
SHA512 5626ee0e6e04b0a1ff647f6dcac3e56e8834725ddf3687fbcce758b822a20c4f38153f5afaac9068f2646fb8a8b5b73d32305b94eb7e16603136f9e1b7b35ff1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1bd235d6c1256175e8c2ce57c442d467cd49aa619b91de052b745db220b031ab
MD5 6dfdefe6a905114573b680d1b12e755b
SHA1 9ebc225f49fa09c99b7b8371a5994bf0be107db6
SHA512 4a8c15a4e044c4087c14c1bf8c71c1f2242fe92d806e4ddbb05e39a0df614341ce04109acb3e07686d7ca70433056413ae6a4b88c3a4771c6a1f8ee694b7cf9a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d6421664978b9a69361e13f2c748957b387a1ebe1c89a0cff724013fb5eaa156
MD5 151333e404bf6662174fd49b3ae49bfd
SHA1 f84973c35ff2738d47b67f1bcd5458ef65f947c6
SHA512 9e8d6d5658d56c744297193320eab14880aee000faf33adff3c4d5acf6644a524163190b1604d0f55ad49cda6a4e0a1550950b921ee69c1d529bd2a703037640
MD5 SHA1 SHA512

Submit Download

svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBAAACCACCCBBCBCBCACCBBBBCBCAAACBCAAAAACABAACBACBAC.exe
Size 12.2MB
SHA256 6287751cf7c6eb9046a477058e36acdf9c04f93b9ded5d8fb8f78628b3ddd0c9
MD5 05692e667e7ed67985871dfd524fd7ca
SHA1 ef82e791b2eef00180d851685f35cf4b43067400
SHA512 e46df776d05c01fd0689a0afef2b18f3cd840ccc50ee23af2d14fe4dfc3710504d8bc0b7a0aa3eed3d11aacc5d6ce8d16b6f04b415b2b0ec954e49b323fa8842
SSDEEP 98304:fccccccccq/fh6ImzzJoDfuBcMv+A73XA8:KHh6ImzD+F8
TLSH
T149D67C42FAC744B1E913017148AB92BF5231BD114F32CBD7E784AB6EE933BD15A32256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3c85d0d832c697ad499dd000443b6352d7d55613935d1a07e701a61f793e0675
MD5 3847dcd21397fba71d78f3aea0376870
SHA1 7ab117a4094b4027fb9deb3b24ad306d6ac64a7c
SHA512 d1b89c9c5937f86b71932dccf124d27a446b7ac0b173973d1f6fb923a585e9fdf96d6fc89ee1ed9aee6138fc5cb07dd4bd045c4d6cb174d76df1746a75b9b223
TLSH
T1BB113D32D4F6CCA3F83368EB65195B530CE831DB599C6A4823060318FB80C34CE254F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4288-7-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/4288-0-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/4604-81-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/4940-79-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/6212-24-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/6212-34-0x0000000000080000-0x00000000000A1000-memory.dmp

Download