8bc957e6753a0ab863cda39e598ca8468d77c5e49c5637b6c2d30b66ea044fe8

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_738495261a1e837da76dc9bf1f7c0015_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 13.4MB
Sample260827-sd3ecav1ev
SHA256 8bc957e6753a0ab863cda39e598ca8468d77c5e49c5637b6c2d30b66ea044fe8
MD5 738495261a1e837da76dc9bf1f7c0015
SHA1 7726eb1bc9314b396f791836e5f0ab84fe82169b
SHA512 5c40a20d20f9fbb22d1c2584e33bc576a2ebb9a42f0d7ee0ec49a82ccc8c1ffbd87811ae23ffc42921a3e29b13e75d2f01136bd2f323495addaeba371aa825f0
SSDEEP 49152:U+Eo+Eviw2Q+ES+Eo+Eviw2ev+Eo+Eviw2Q+ES+Eo+Eviw2ev+Eo+Eviw2Q+ES+G:u/fh6ImzzJoDfuBcMv+A73XAD
TLSH
T186E64B05FAEE44B4E967613049A7C27F9672B8118732CBDFD244872E9E33AE16C34716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5928	svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe
1704	svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe
2688	svchost_ACACAAAAAAACCABBACCBCBCAACCBCCCAACBCABCCCBBBBBBACCBCBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABAABABCCABAACCACAAAAAAACCAABCAAABACAAACCABBCBCBBCACAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACAAAAAAACCABBACCBCBCAACCBCCCAACBCABCCCBBBBBBACCBCBCA.exe"	svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBCCBBBCBABCACABABCCBCBACCBACACBAACCCBACBBACBACACBBCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe"	2026-08-27_738495261a1e837da76dc9bf1f7c0015_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5848	sc.exe
2264	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4516	cmd.exe
4444	cmd.exe
2932	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_738495261a1e837da76dc9bf1f7c0015_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACAAAAAAACCABBACCBCBCAACCBCCCAACBCABCCCBBBBBBACCBCBCA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4600	2026-08-27_738495261a1e837da76dc9bf1f7c0015_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4600	2026-08-27_738495261a1e837da76dc9bf1f7c0015_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4600	2026-08-27_738495261a1e837da76dc9bf1f7c0015_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4600	2026-08-27_738495261a1e837da76dc9bf1f7c0015_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5928	svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe
5928	svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe
5928	svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe
5928	svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe
2688	svchost_ACACAAAAAAACCABBACCBCBCAACCBCCCAACBCABCCCBBBBBBACCBCBCA.exe
2688	svchost_ACACAAAAAAACCABBACCBCBCAACCBCCCAACBCABCCCBBBBBBACCBCBCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	2026-08-27_738495261a1e837da76dc9bf1f7c0015_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	5928	svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe
Token: SeDebugPrivilege	2688	svchost_ACACAAAAAAACCABBACCBCBCAACCBCCCAACBCABCCCBBBBBBACCBCBCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4516	4600	2026-08-27_738495261a1e837da76dc9bf1f7c0015_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	92
PID 4516 wrote to memory of 5624	4516	cmd.exe	94
PID 5928 wrote to memory of 4700	5928	svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe	95
PID 4600 wrote to memory of 4444	4600	2026-08-27_738495261a1e837da76dc9bf1f7c0015_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	96
PID 4444 wrote to memory of 5848	4444	cmd.exe	98
PID 4600 wrote to memory of 2932	4600	2026-08-27_738495261a1e837da76dc9bf1f7c0015_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	99
PID 2932 wrote to memory of 2264	2932	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-27_738495261a1e837da76dc9bf1f7c0015_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_738495261a1e837da76dc9bf1f7c0015_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCACACABCCABCBBCCCABABCCACCBCABBBCACBAAACCCAACCCCBCACBBBBABACBCCABBCABABBBBBBBBABBBCACCCBCBAABABAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCACACABCCABCBBCCCABABCCACCBCABBBCACBAAACCCAACCCCBCACBBBBABACBCCABBCABABBBBBBBBABBBCACCCBCBAABABAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCACABBCBBBCBACCBCBAACACABACBCCABACBAACCCBCBCCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe" start= auto displayName= "UserDataSvc_AACCACABBCBBBCBACCBCBAACACABACBCCABACBAACCCBCBCCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCACABBCBBBCBACCBCBAACACABACBCCABACBAACCCBCBCCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe" start= auto displayName= "UserDataSvc_AACCACABBCBBBCBACCBCBAACACABACBCCABACBAACCCBCBCCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCACABBCBBBCBACCBCBAACACABACBCCABACBAACCCBCBCCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCACABBCBBBCBACCBCBAACACABACBCCABACBAACCCBCBCCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5928
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe
1⤵
- Executes dropped EXE
PID:1704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAAAAAAACCABBACCBCBCAACCBCCCAACBCABCCCBBBBBBACCBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAAAAAAACCABBACCBCBCAACCBCCCAACBCABCCCBBBBBBACCBCBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d05c192b7f9d09452e1007c61e7494780bee6186e94557598396e1b41075666b
MD5 f0b115b5f3400570b61b51c59f5cfbb5
SHA1 0985edb976bb3732b5435b46f65eead6c9a16b47
SHA512 d332a66cde5294313226b0431fc82d2382c50f62a7b3071e1a7badd6a28da15692b813d1385f4931b0d7930da1840006e439764068b12c30fa552bd2d443ee71
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7f6efde008f5c0c15fc1c7977546c47d36a072a340a0c94f9828ad8431756dfd
MD5 2079ad2fcf33cf9733393cc91a2dc60a
SHA1 b0678adcb4873c4fd88bb823c13808fc77f2aafa
SHA512 179968fb3531d812254397df9bfce024ac4f5ce909a33a882abb42376164e7cf0a042433900c1f22b80efba79d275805e1c54ee5ef62bb9aa6c17b2618648521
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa0e61b73bb2c40f2db60f42df0b562ba9549c2bdff007ce2c7de36ecb39c99b
MD5 ef5f7c387f60da6c6f637c94d48c97fe
SHA1 612025e183caf6d28356ccbcdf1afd5220ce4542
SHA512 545941ad17efb57bb218b0e4e0996558dffb3aa08621e68dd20c18188c35663720013a09223ed90a4ed9ed7877491e3120fd48bf77e336574a1470e1332ebf93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b95dd4d125b9d4417737bf9c880e4b8b20aa1cde8e097be0c1e0a658a697d181
MD5 5b77e6c2e4f645ffac7478a394de2c77
SHA1 c982b5b223caa5f77c7891f62ddda692dbfd1536
SHA512 56bfb77ad28423dc17733e5af30b504519cfcb95cf7512182393fce061cec33f4ae18d5e0c3080de88cd1db27c37ed6c91a8f4c5a63076efd4198e71aff29f8b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b515cb7f1f1a71c23dbe28464fbb7ffc545c8eaff65e2729d1ccfe56ce3063a1
MD5 af4542392a883970513dd7dd43bea99d
SHA1 fb1eeb85064f7c081a22b9c89fdd7fc97113f9ad
SHA512 d0f104855c138698293af26d539d7fcb62bd5d67b6f92598eaad5eb0e41a87bc26bc84d09bf7e9bfdbf7d126890bc10814283a852425045977b5690bf529f3a8
MD5 SHA1 SHA512

Submit Download

OptimizeUnpublish.exe

Path C:\Users\Admin\Downloads\OptimizeUnpublish.exe
Size 41.3MB
SHA256 e9193a2e40164cb4611c91a622bf9adeddcc1d943b9336528911c6d9280e1313
MD5 1f0a8e5753c0bb466bd07919b31d9885
SHA1 ce9d28a951aac77373c0c74b130637698a2c2564
SHA512 28214acdd9207cb7aa5810d7d06775bbf93f5087f9ea37828a1eb6daf7c19fb965e8a5a7c9a9dcf90f0b3919c0910294a792d0a77e2b4a0ccc8f5a74cccd0111
SSDEEP 196608:uHh6ImzD+FaHh6ImzD+FaHh6ImzD+FeUU/:laar/
TLSH
T17D974B05FAEE44B4E967613049A7C27F9672B8118732CBDFD244872E9E33AE16C34716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0b6b380bcc941073fbd0a3ab642b83934f039ca232a94d8ffce6826a0a10313b
MD5 de949d1d94eaa6ce28fddc0815d1a9a4
SHA1 dbfa3784b95670916b3754e1a91528ad9ea7f1d8
SHA512 f940e39c117f98e6386a518dac51b1d5441af115284e8846933966f27fb2b61057e1daa2f3a9b8a1d6ce8efb11bbf907920b49ce6a50af2f3ee8f95dc7c2b1f1
MD5 SHA1 SHA512

Submit Download

svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACAABBCCCCACCBCACCBBABCBBBBCBBABABCACAACCAACCAAAAB.exe
Size 13.4MB
SHA256 8bc957e6753a0ab863cda39e598ca8468d77c5e49c5637b6c2d30b66ea044fe8
MD5 738495261a1e837da76dc9bf1f7c0015
SHA1 7726eb1bc9314b396f791836e5f0ab84fe82169b
SHA512 5c40a20d20f9fbb22d1c2584e33bc576a2ebb9a42f0d7ee0ec49a82ccc8c1ffbd87811ae23ffc42921a3e29b13e75d2f01136bd2f323495addaeba371aa825f0
SSDEEP 49152:U+Eo+Eviw2Q+ES+Eo+Eviw2ev+Eo+Eviw2Q+ES+Eo+Eviw2ev+Eo+Eviw2Q+ES+G:u/fh6ImzzJoDfuBcMv+A73XAD
TLSH
T186E64B05FAEE44B4E967613049A7C27F9672B8118732CBDFD244872E9E33AE16C34716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1ee3d2a74451cd3ce169496a4b9bcfe832765bd7e788d18ed86ffc22332cc9d6
MD5 91dfb294309f580c39c5dfbbf790da63
SHA1 6572ad4a2acb248808efb29318adbdf8406f45b4
SHA512 93a6baabaf8d6bd0a7b58e71a7858fd03f9b02907ecc9e7e215836c2205efa2f23d697e30279f8335040e082943a20b49b63a73006ab5cb4f8efdce1e9905b86
TLSH
T1B5110660F1F59827F4332DCFA22ADAA32CE8378F5DD46A242208521D63A6C218D556E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1704-102-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/2688-109-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/4600-60-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/4600-0-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/4600-86-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/4600-34-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/4600-22-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/4600-11-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/5928-72-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/5928-51-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/5928-33-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download