e3c54d73ae11840b3aaead73c265fb146be05fcb9cc1c67f441681f5b38a915f

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 08:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_c56e87bb880d0afc0394cc9e3ada545d_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 7.7MB
Sample260827-kq77cssbkh
SHA256 e3c54d73ae11840b3aaead73c265fb146be05fcb9cc1c67f441681f5b38a915f
MD5 c56e87bb880d0afc0394cc9e3ada545d
SHA1 21b174f879f5de301a8935d1764b78fe317ef10e
SHA512 ce99ddce40cd6a74ad2ba251e1671bd594ec50e2ce0de656f0a7c367d3e4ce7f139309659b08c7621158982b6e60390649711a1b617e24b94f2bbb40ac655475
SSDEEP 49152:U+Eyiw2n+Eyiw2n+Eyiw2n+Eyiw2n+Eyiw2n+Eyiw2n+Eyiw2n+Eyiw2n+Eyiw2s:p/fh6ImzzJoDfuBcMv+A73XA1
TLSH
T1F7865B05FAEF44B4E9A3663049A6836F9632B8018731C7CFD2809B3EDE63AD15D35716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2820	svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe
3392	svchost_CABACCBACBACCAABCCBBBACCBBCBABBACCCBCCCBABCCCBAACAABCBB.exe
3304	svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABABCCCBCBAAABCBCAACBACBBAABBABCCCAACBBCBBCACABBBACCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe"	2026-08-27_c56e87bb880d0afc0394cc9e3ada545d_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBBBBCCABCCBBAAABBBBCBCACCBABBBCBCBBBCCCABBCCCAABCAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABACCBACBACCAABCCBBBACCBBCBABBACCCBCCCBABCCCBAACAABCBB.exe"	svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5096	sc.exe
4776	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2588	cmd.exe
5348	cmd.exe
4212	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_c56e87bb880d0afc0394cc9e3ada545d_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABACCBACBACCAABCCBBBACCBBCBABBACCCBCCCBABCCCBAACAABCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2972	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4892	2026-08-27_c56e87bb880d0afc0394cc9e3ada545d_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4892	2026-08-27_c56e87bb880d0afc0394cc9e3ada545d_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4892	2026-08-27_c56e87bb880d0afc0394cc9e3ada545d_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4892	2026-08-27_c56e87bb880d0afc0394cc9e3ada545d_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2820	svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe
2820	svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe
2820	svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe
2820	svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe
3392	svchost_CABACCBACBACCAABCCBBBACCBBCBABBACCCBCCCBABCCCBAACAABCBB.exe
3392	svchost_CABACCBACBACCAABCCBBBACCBBCBABBACCCBCCCBABCCCBAACAABCBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	2026-08-27_c56e87bb880d0afc0394cc9e3ada545d_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	2820	svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe
Token: SeDebugPrivilege	3392	svchost_CABACCBACBACCAABCCBBBACCBBCBABBACCCBCCCBABCCCBAACAABCBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 2588	4892	2026-08-27_c56e87bb880d0afc0394cc9e3ada545d_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	91
PID 2588 wrote to memory of 2972	2588	cmd.exe	93
PID 2820 wrote to memory of 1692	2820	svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe	94
PID 4892 wrote to memory of 5348	4892	2026-08-27_c56e87bb880d0afc0394cc9e3ada545d_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	97
PID 5348 wrote to memory of 5096	5348	cmd.exe	99
PID 4892 wrote to memory of 4212	4892	2026-08-27_c56e87bb880d0afc0394cc9e3ada545d_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	100
PID 4212 wrote to memory of 4776	4212	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-27_c56e87bb880d0afc0394cc9e3ada545d_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_c56e87bb880d0afc0394cc9e3ada545d_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACCBAAAAABCBAACCAABCBCABACCCCABAACACCACCBBBCCBACBCCACBBCABACAACACACBAAAACCCBCACCAAAABBCBBCCAAAABBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACCBAAAAABCBAACCAABCBCABACCCCABAACACCACCBBBCCBACBCCACBBCABACAACACACBAAAACCCBCACCAAAABBCBBCCAAAABBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACACBBCABBCBCCBBBCCBAACAAABAACBBACAABCABBCABCBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe" start= auto displayName= "UserDataSvc_BAACACBBCABBCBCCBBBCCBAACAAABAACBBACAABCABBCABCBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACACBBCABBCBCCBBBCCBAACAAABAACBBACAABCABBCABCBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe" start= auto displayName= "UserDataSvc_BAACACBBCABBCBCCBBBCCBAACAAABAACBBACAABCABBCABCBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACACBBCABBCBCCBBBCCBAACAAABAACBBACAABCABBCABCBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACACBBCABBCBCCBBBCCBAACAAABAACBBACAABCABBCABCBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBACBACCAABCCBBBACCBBCBABBACCCBCCCBABCCCBAACAABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBACBACCAABCCBBBACCBBCBABBACCCBCCCBABCCCBAACAABCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe
1⤵
- Executes dropped EXE
PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3a153c09add6b0d89d3c48f79c838a16ce4d86d012544612c2ff4297c7b363fe
MD5 452af85a70b264a088e3e91ffd8c4567
SHA1 87781d3c49ea1b0a1ec121a44e7e358f6c7d9a6d
SHA512 5959f5ada9a96f46770aa38ae5e6543c79f9c401bde4bc16920a33e93d9c1ca48adb34e32373f7f0b6738b2f564903cec27fe3306e5f46dca1eed83ac6193f30
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b2aaf1e7f32a71581dfa5fbec1d7c53349e733093db39c04ccf0b354dd8c17df
MD5 c746ad07c76d1f83636c93ad59e1c202
SHA1 1ab49c94ee988b41d19e12434b0a8f5c6584418b
SHA512 eb7d26a49eca3375a3111afa23009679c566f02841d5d57e3d8f63a886a5b2e99f35c976e611cee8d006de5ead6f04c536364b185111b72ce6d9ad39880ece92
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1421e8b559cfcb1b1edb91db4416816028e173f10a511b007d9b0c1b99de9cff
MD5 9f6bd730887b454a516f4fbf82e14e0b
SHA1 f06bffc7c5ae548defde0cfa60ea4c8ccdefe31f
SHA512 b46069c26865eaa668fc02325c67aa804f3f6bf78121332e9daa4b0f96aea0aa24fdfd53f6f2ffe36b159159e2d5fb675ff8ad69b307e7b739276ba91cfa8eaa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e4d04fed34899971a448cea4b9dcc63accfbfe69158ad269a5fc90984c9e54f8
MD5 2a71677baf803c34beff6cde28aef6e0
SHA1 f40a8132e4ab9ad16121da3c27ab02bf06f01745
SHA512 d28ebb1a309d96ca2ee1f4570efec20b430f35f024a50d1fede11be8aa77dae841910f0197febeee6ca1f559dec93bc2d8aeb371e1b9fd34bd6dc75a550e81e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 81b1d62d6e34f2f633d4dbee407db93184672840d43eb58b25e4dc75555ab60e
MD5 d14dd19ad132e99905bb35f976ec37c4
SHA1 d21309ed96d5d608070b7c35c029c7967863619a
SHA512 3e564be42e8e290aba297801e061b8a6bd1c8cb7dc294c397ad5efdcf5d8e573a18f87771d156381e508cb529ef1f2d8ef00f10ed547d15b1f0f6d78f2d750a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 df7d88ab97cad5d4979ea71887b669523c80988d14878a31e2fc4bed66d94580
MD5 00284404589d91e47a1c4efde2fa29ac
SHA1 9c627225ddcea40461b25d175dad2d94586f4e60
SHA512 c05c49581be527fc687f20092e0fd642ba935fd7159d824555562dceda6aff3749e93c3b27187bb3ce915a6e1fa3e0ca940fdeb2d1d3ed97ae80c5c555ed8297
MD5 SHA1 SHA512

Submit Download

svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCBBCACCCBAAABCCCBABCABBBBBCCABABBBABCACABBCCBACABB.exe
Size 7.7MB
SHA256 e3c54d73ae11840b3aaead73c265fb146be05fcb9cc1c67f441681f5b38a915f
MD5 c56e87bb880d0afc0394cc9e3ada545d
SHA1 21b174f879f5de301a8935d1764b78fe317ef10e
SHA512 ce99ddce40cd6a74ad2ba251e1671bd594ec50e2ce0de656f0a7c367d3e4ce7f139309659b08c7621158982b6e60390649711a1b617e24b94f2bbb40ac655475
SSDEEP 49152:U+Eyiw2n+Eyiw2n+Eyiw2n+Eyiw2n+Eyiw2n+Eyiw2n+Eyiw2n+Eyiw2n+Eyiw2s:p/fh6ImzzJoDfuBcMv+A73XA1
TLSH
T1F7865B05FAEF44B4E9A3663049A6836F9632B8018731C7CFD2809B3EDE63AD15D35716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 db0ba3131cc3ccef0080d4e27f582e4a9e3e3d423329b78106ee91cc7e8828da
MD5 69065a26c82910ddc76bba0b55887d39
SHA1 a6e4c2cb4c0aeddbab63f2f47d81a9776aad14dc
SHA512 1d301e63555995298da914c3912233e741df0ff47cedbc8d5cfd1484e0195a4c417f405626bf35a4044e69a71de2995432851c227ffb7d54fb527b573ec491b6
TLSH
T163115920D0F5D873E83239CF5232D9C228E8B79E1C9C6A00338DE31C63A8C36AD554E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2820-34-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/3392-74-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/4892-0-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/4892-8-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download