0d886c1332d354ef13a248a2a2f9431cd25c94420f524978502ccd62c7aa4a7d

Analysis

max time kernel
151s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_7e8f6841a7a7fca43e517dda1806054d_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Size 64.9MB
Sample260825-lfktrawvhx
SHA256 0d886c1332d354ef13a248a2a2f9431cd25c94420f524978502ccd62c7aa4a7d
MD5 7e8f6841a7a7fca43e517dda1806054d
SHA1 917d3f2027eedf40cf93e6f1ea9715beea6ddfa2
SHA512 96db8dfc77a4eda5b6af4615a4af763deafd675a91e6733b70ff920283f5cb90ca5033e5873ce55f730e33c72ded0f44ec497c09e0578ba70f5aca19d6711678
SSDEEP 393216:YmHN6+Jrv1mHN6+JrvgmHN6+Jrv1mHN6+JrvgmHN6+Jrv1mHN6+Jrvsd:JbrwbrZbrwbrZbrwbrUd
TLSH
T156E77B5A62AB10F9D46FD176C6A68332D2707823033157DB527CCA3E2F676906D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4172	svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe
728	svchost_ACBBCCBBACABBBACABBBCBBBBBCAAAAAACCAABACBCCBACBACCBBCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABBBCCAACACBBBAACCACABBCCCABAABCCBCBBBBCACABABABBBCCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe"	2026-08-24_7e8f6841a7a7fca43e517dda1806054d_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCCBBCCCACACABABACABCAACABBAACACCCCBCBCABCAABCCCBAAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBCCBBACABBBACABBBCBBBBBCAAAAAACCAABACBCCBACBACCBBCBA.exe"	svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5052	sc.exe
5752	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4340	cmd.exe
2620	cmd.exe
4816	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBCCBBACABBBACABBBCBBBBBCAAAAAACCAABACBCCBACBACCBBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_7e8f6841a7a7fca43e517dda1806054d_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4128	2026-08-24_7e8f6841a7a7fca43e517dda1806054d_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
4128	2026-08-24_7e8f6841a7a7fca43e517dda1806054d_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
4128	2026-08-24_7e8f6841a7a7fca43e517dda1806054d_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
4128	2026-08-24_7e8f6841a7a7fca43e517dda1806054d_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
4172	svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe
4172	svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe
4172	svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe
4172	svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	2026-08-24_7e8f6841a7a7fca43e517dda1806054d_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Token: SeDebugPrivilege	4172	svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4340	4128	2026-08-24_7e8f6841a7a7fca43e517dda1806054d_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe	92
PID 4340 wrote to memory of 4576	4340	cmd.exe	94
PID 4172 wrote to memory of 2844	4172	svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe	95
PID 4128 wrote to memory of 2620	4128	2026-08-24_7e8f6841a7a7fca43e517dda1806054d_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe	98
PID 2620 wrote to memory of 5052	2620	cmd.exe	100
PID 4128 wrote to memory of 4816	4128	2026-08-24_7e8f6841a7a7fca43e517dda1806054d_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-24_7e8f6841a7a7fca43e517dda1806054d_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_7e8f6841a7a7fca43e517dda1806054d_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAABBACABAACBABAABACCABCCBAACCACBCCABCCCCACBAACABABBACBBBBCBCAACCBACCBABCCBBBBCBBCAABCCCCACBBABACABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAABBACABAACBABAABACCABCCBAACCACBCCABCCCCACBAACABABBACBBBBCBCAACCBACCBABCCBBBBCBBCAABCCCCACBBABACABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBCBAAAAACBBCCAACAABCBBAABCAAACCBCCBCACACACBBBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe" start= auto displayName= "UserDataSvc_CCBBCBAAAAACBBCCAACAABCBBAABCAAACCBCCBCACACACBBBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBCBAAAAACBBCCAACAABCBBAABCAAACCBCCBCACACACBBBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe" start= auto displayName= "UserDataSvc_CCBBCBAAAAACBBCCAACAABCBBAABCAAACCBCCBCACACACBBBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBCBAAAAACBBCCAACAABCBBAABCAAACCBCCBCACACACBBBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4816
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBCBAAAAACBBCCAACAABCBBAABCAAACCBCCBCACACACBBBBAB"
    3⤵
    - Launches sc.exe
    PID:5752

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2844

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCBBACABBBACABBBCBBBBBCAAAAAACCAABACBCCBACBACCBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCBBACABBBACABBBCBBBBBCAAAAAACCAABACBCCBACBACCBBCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:728

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACACBBCACCBACCCAABCAAABCCABBCCAAACBCCBCACABBBABACBBA.exe
1⤵
PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bf5e69a925c05f2f58bc649a031f111957ee96149494945b5bb2e54ece186eb0
MD5 14b533ab444122c2c3e71169a4a7dfe9
SHA1 780d3d1f6217040540158a25dc162165dc3424f3
SHA512 840d26fe8c342a13f02055c6a77ed9af8e06aeda340acd40ab78950afbca64af3d031376e84f347cfab21d371c799f90a97a43dce46c02947a2abff2e05188d7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cb8fed9409d30c11f069cb0c34a0291f215d955da334b6026291e5119cda2652
MD5 4ae6d62490c4db67f03fbd4126334fdf
SHA1 89593b1f24ebf53ef63dbb86a6e000eac47b4ac5
SHA512 9d23bc5b639b16517a180c34d8222f74ccf6cac756e26444ba1be8a4477fa93d69419e134dc203bef4a2255ce7b2703c6b19ff837a1c5f39ae5f8b41865d1283
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f340dcc5fd51bd2ba6aba8556f72af08d5a0942d2a8b4f8f18476c207f127349
MD5 43cca9e589063b7c023b6925b1097b9a
SHA1 94feb98d1723b19d38813d9644e9dc7c189b189d
SHA512 24f909fd4213f27567e56d92f23e7a345e53b98c8a1d5085defba21f87168f5964aafea6dfd15ce65b9b6e4417d869875aded3611d7fc9fd5f6f9e44f25dce5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 36055808306a9943709519c83613989965d7a6febd871e955b437c0c9d55827a
MD5 807f650bb8ff3ac36d236afb1377ea62
SHA1 3dbffe2a827fa3131e04d57e1ad49a398f73fd7b
SHA512 b714ef34ec38f0882f96c315214bd53cf18a9139e07231bbe72a5a6b640181cdd50b9af6d3ad6532f9cc59bd9bedc6e79fdf09851e5e3346698c1f794c27d139
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9be6143d976e52b292c603cfd73dc389ad4964c45faad3bf3c817c952cbd9c7f
MD5 c11d2c961ae14619e31ceef0dca3e305
SHA1 2f0be5d2919d0e0fc26806dabcfcba14173488d2
SHA512 f997e9afb32f4f5b0101ff84b9b7d505dc8b6cd75f3db67f0303ff3cc54259bad9f0a6e40162d127d0bdd1411e68bf92627b9537191fe2c60b66b1f7bf8f6d4b
MD5 SHA1 SHA512

Submit Download

memory/728-79-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/4128-69-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/4128-48-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/4128-0-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/4128-72-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/4128-23-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/4128-12-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/4172-49-0x0000000000D40000-0x0000000000D61000-memory.dmp

Download

memory/4172-70-0x0000000000D40000-0x0000000000D61000-memory.dmp

Download