Overview

overview

7

Static

static

3

2026-08-20...at.exe

windows10-2004-x64

7

2026-08-20...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 18:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_3eda722953f8ca7f9ff8a0871be26b74_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
  • Size 4.2MB
  • Sample260820-wld89swtby
  • SHA256 1edc0c83f55259affa02aeff183068f1a0812c2a10a2659b56aafe14a9283fac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 4 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_3eda722953f8ca7f9ff8a0871be26b74_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_3eda722953f8ca7f9ff8a0871be26b74_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4604
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACAACBBBBBCCBCACCBBCBCCAACAACCABBACACBCBAAABABBBBCBCACABCACABCACBABACAABBABACACBBCABCBBCABBABCAABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCABCCCAACBCBCCAAABCACBBACAAACAAACBAACBBBBBBBAAACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4872
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACAACBBBBBCCBCACCBBCBCCAACAACCABBACACBCBAAABABBBBCBCACABCACABCACBABACAABBABACACBBCABCBBCABBABCAABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCABCCCAACBCBCCAAABCACBBACAAACAAACBAACBBBBBBBAAACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3776
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBBAAAAAAACAACCCAACBACACAABBCCBCCCBABACABBCACCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCABCCCAACBCBCCAAABCACBBACAAACAAACBAACBBBBBBBAAACCBC.exe" start= auto displayName= "UserDataSvc_AACBBAAAAAAACAACCCAACBACACAABBCCBCCCBABACABBCACCABA"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1740
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_AACBBAAAAAAACAACCCAACBACACAABBCCBCCCBABACABBCACCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCABCCCAACBCBCCAAABCACBBACAAACAAACBAACBBBBBBBAAACCBC.exe" start= auto displayName= "UserDataSvc_AACBBAAAAAAACAACCCAACBACACAABBCCBCCCBABACABBCACCABA"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3060
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBBAAAAAAACAACCCAACBACACAABBCCBCCCBABACABBCACCABA"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2596
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_AACBBAAAAAAACAACCCAACBACACAABBCCBCCCBABACABBCACCABA"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1976
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCABCCCAACBCBCCAAABCACBBACAAACAAACBAACBBBBBBBAAACCBC.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCABCCCAACBCBCCAAABCACBBACAAACAAACBAACBBBBBBBAAACCBC.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Windows\notepad.exe
      "notepad.exe"
      2⤵
        PID:3488
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBCAAACACBAACCABCCCCABCACAABBBBAACACBCBBCACBCBBBCACBABAAABCAAAACACAABBCAABCBACABCBACAACAACACCBBACCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABCACACCBBAAAAABBABAAABABAACCBCBBBCABBBBCABBACCBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1604
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBCAAACACBAACCABCCCCABCACAABBBBAACACBCBBCACBCBBBCACBABAAABCAAAACACAABBCAABCBACABCBACAACAACACCBBACCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABCACACCBBAAAAABBABAAABABAACCBCBBBCABBBBCABBACCBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:5952
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABCACACCBBAAAAABBABAAABABAACCBCBBBCABBBBCABBACCBBCA.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABCACACCBBAAAAABBABAAABABAACCBCBBBCABBBBCABBACCBBCA.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5268
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCABCCCAACBCBCCAAABCACBBACAAACAAACBAACBBBBBBBAAACCBC.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCABCCCAACBCBCCAAABCACBBACAAACAAACBAACBBBBBBBAAACCBC.exe
      1⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1176

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          qap`g`v~dtlq
          • Path C:\PerfLogs\qap`g`v~dtlq
          • Size 10B
          • SHA256 e7a6c58c8b99731546228720ef67e3725efcff5d155af7361ed5e71fd189d278
          • MD5 SHA1 SHA512
          Submit Download

          windowsdesktop-runtime-8.0.15-win-x64.exe
          • Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
          • Size 4.8MB
          • SHA256 b303bc59c64441336ad563e047a39e08da1cea887b8d7fb21a8f65cae3974193
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
          • Size 10B
          • SHA256 b5903c9c7553bd0aeb59c29635e3bc44708e8b6be5293f3deb0505f0b6d4ee7a
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\qap`g`v~dtlq
          • Size 10B
          • SHA256 3beddfe3310cd8c2aa978dae3e0106321001471be1060136b45a441e7f2e5785
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
          • Size 10B
          • SHA256 0401ea58353f7b497a521971dee544f19361a073eb5a84767c7204f1ab1bc532
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\tsfe9afu.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\qap`g`v~dtlq
          • Size 10B
          • SHA256 25a757be33cfb2ed4aaa0785b34e5420bcd9ebcb512103669e4271e68b16e3c9
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\extension-store-menus\qap`g`v~dtlq
          • Size 10B
          • SHA256 910c88adf78c193c135810d029de7cca12b9ed1859a3dafc183210395f9a5847
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 0c8fb1a46aa6eee3a65717ec7600428738ba77906df06f0c0996442e64977728
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 0037825cae4a11584f6feb58aee06d44be162b1faadb116a63534375e7c8414c
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 81c7a23ec2bd97471244af154ecdf88e36c97d096404404f261c77b584343761
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 1e60aebeebbd7395e12725cf956e63f0dd55524c953aa846d191e6d5e88fc13b
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 6ceab8c1121a79feaca1211c7441a75cc7d6d92f5ea1b428b0ccab804c84ec33
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
          • Size 10B
          • SHA256 54cb25b5a61c1d84564a387c37ba9e2ec1ecbb18aa78db85fe73c7b6422d34d1
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\qap`g`v~dtlq
          • Size 10B
          • SHA256 72de5cfcaad84db16fe3b9698e9f710963770d3c8d8f7bd6e8001cccfe42039d
          • MD5 SHA1 SHA512
          Submit Download

          svchost_ACBCCABCCCAACBCBCCAAABCACBBACAAACAAACBAACBBBBBBBAAACCBC.exe
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCABCCCAACBCBCCAAABCACBBACAAACAAACBAACBBBBBBBAAACCBC.exe
          • Size 4.2MB
          • SHA256 1edc0c83f55259affa02aeff183068f1a0812c2a10a2659b56aafe14a9283fac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 1KB
          • SHA256 7c8d80136ae7ac21c721d29165094590e17bdee865823cc2b3ad93e97789d2db
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 1KB
          • SHA256 aa96defaef0bf6aff847b202f619975aedc16c21447ae73bae16ff8c938e773c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 926B
          • SHA256 e37bcfc342d83123cdd4ef9d13cfaa0fb5eaf3cca1099ee66b2554b77537d3a1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1176-2556-0x0000000000D00000-0x0000000000D21000-memory.dmp
          Download

          memory/1900-33-0x0000000000D00000-0x0000000000D21000-memory.dmp
          Download

          memory/4604-0-0x0000000000420000-0x0000000000441000-memory.dmp
          Download

          memory/4604-7-0x0000000000420000-0x0000000000441000-memory.dmp
          Download

          memory/5268-63-0x00000000004D0000-0x00000000004F1000-memory.dmp
          Download

          memory/5268-4038-0x00000000004D0000-0x00000000004F1000-memory.dmp
          Download