c1d5eb18becf0ac8168a30e4bf78cfdf83395624a7e45fe92c5eaa37613fcc5c

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-29_fd5e1ff8a3f829beb3247e92b5f82022_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 12.4MB
Sample260830-2tegwsdg32
SHA256 c1d5eb18becf0ac8168a30e4bf78cfdf83395624a7e45fe92c5eaa37613fcc5c
MD5 fd5e1ff8a3f829beb3247e92b5f82022
SHA1 3e0f6eafe4995c2518fdb3149410894f51c712ba
SHA512 793a970a4c5088d1885a92aa9e8a0ef5423460caba123bc37450adb269aa5d90f581e27bbcb9568d43a3a9336785fb7e298dc196b42579c741e70d528da5647a
SSDEEP 49152:U+ES+Ed+ES+EZDiw2J+ES+Ed+ES+EZDiw2J+ES+Ed+ES+EZDiw2J+ES+Ed+ES+ER:G/fh6ImzzJoDfuBcMv+A73XAM
TLSH
T1B6D64A05FADF44B4E573623049A7827F9632B9118731CADFE2848B2E9D63BD09D35722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3900	svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe
1468	svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe
4656	svchost_CBBACCCBBACBACACAAABBAAACCBACACCCACABBCCBBCABCCBBCABBAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAAAACCABBAACCBAAAABAAACCBAABABCCBCACCCCBBAACBBAABBACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe"	2026-08-29_fd5e1ff8a3f829beb3247e92b5f82022_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBBBCBBBABBBABBABBCABCCACCAABBCCCBBAAAAABBCBCAABCCCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBACCCBBACBACACAAABBAAACCBACACCCACABBCCBBCABCCBBCABBAA.exe"	svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6060	sc.exe
1976	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4788	cmd.exe
2384	cmd.exe
2612	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-29_fd5e1ff8a3f829beb3247e92b5f82022_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBACCCBBACBACACAAABBAAACCBACACCCACABBCCBBCABCCBBCABBAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
240	2026-08-29_fd5e1ff8a3f829beb3247e92b5f82022_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
240	2026-08-29_fd5e1ff8a3f829beb3247e92b5f82022_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
240	2026-08-29_fd5e1ff8a3f829beb3247e92b5f82022_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
240	2026-08-29_fd5e1ff8a3f829beb3247e92b5f82022_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3900	svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe
3900	svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe
3900	svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe
3900	svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	240	2026-08-29_fd5e1ff8a3f829beb3247e92b5f82022_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	3900	svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 4788	240	2026-08-29_fd5e1ff8a3f829beb3247e92b5f82022_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	96
PID 4788 wrote to memory of 4820	4788	cmd.exe	98
PID 3900 wrote to memory of 1840	3900	svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe	101
PID 240 wrote to memory of 2384	240	2026-08-29_fd5e1ff8a3f829beb3247e92b5f82022_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	102
PID 2384 wrote to memory of 1976	2384	cmd.exe	104
PID 240 wrote to memory of 2612	240	2026-08-29_fd5e1ff8a3f829beb3247e92b5f82022_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	105
PID 2612 wrote to memory of 6060	2612	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-29_fd5e1ff8a3f829beb3247e92b5f82022_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-29_fd5e1ff8a3f829beb3247e92b5f82022_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBABBBAAAACBBCBBABBACCCBBBBBABBBBCACBCAACBCCCCACBCBBCBCABBBBCCBBBCCCCCCBCBBBACAACACABBBBBBAAACBBABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBABBBAAAACBBCBBABBACCCBBBBBABBBBCACBCAACBCCCCACBCBBCBCABBBBCCBBBCCCCCCBCBBBACAACACABBBBBBAAACBBABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAABCCBACCAAABABABCBCCCCCAABAACCAAAAABCBCABCCACCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe" start= auto displayName= "UserDataSvc_ABAABCCBACCAAABABABCBCCCCCAABAACCAAAAABCBCABCCACCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAABCCBACCAAABABABCBCCCCCAABAACCAAAAABCBCABCCACCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe" start= auto displayName= "UserDataSvc_ABAABCCBACCAAABABABCBCCCCCAABAACCAAAAABCBCABCCACCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAABCCBACCAAABABABCBCCCCCAABAACCAAAAABCBCABCCACCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAABCCBACCAAABABABCBCCCCCAABAACCAAAAABCBCABCCACCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe
1⤵
- Executes dropped EXE
PID:1468

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBBACBACACAAABBAAACCBACACCCACABBCCBBCABCCBBCABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBBACBACACAAABBAAACCBACACCCACABBCCBBCABCCBBCABBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 512KB
SHA256 969898e85171b966076392d26f07815c2363861eca426f1bc7bfb2b07cdf0ffe
MD5 5c0aaffbfee91e24e1b35c85d7d76094
SHA1 bd4a1db3047107879fafbd035fd513d88e9f658f
SHA512 c3b54dbca287c7c1b7e12bda37cf1215971b11f4da2dbd2d29870dbf3efe632b15ce438d96969416532e66f6282f52cd675f62c1f7ca6639da7738e4774f5067
SSDEEP 12288:mgUFgEsnojA9gUFgEsnojAeS2jgUFgEsnojA9gUFgEsnojAe6:m9+EM0q9+EM0p9+EM0q9+EM0K
TLSH
T1C1B42905FD8A54B5E97B41B04DEBD2BE8530BE258712CDEFF649870E6833BD09935222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7f66d2c9b4009b4198bb68fa1a8291ec13a12551f4cdce7937fc65e87376b5e7
MD5 928129bf6d2c88328f1cda49c2518ff6
SHA1 a591d1fb9329052c3cee246df99e332b7b357bb6
SHA512 4d6392b8cd173fe046c6d33cdde75d7cac482dcf4cfd7103115876cbbdbd63b448884f424ef6587eba867f238610474e4f8afcc3e4cb3bf89d6031ea6a7b3213
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b43e1081388576bc8839b1741927eba6d7f552d4b26f694ed36f839953628f49
MD5 96786b4ad735e21354600b14e1c66be5
SHA1 22e101a22eccd7f1d2440016c88e0408a0428297
SHA512 4e39a7d9aee0615a14de3bfab373ffe356f430b4d241170c22a7526c8683ca60313064f4d6a6c226369ad7fd759b7439f6c300533c143203558204dc79312af5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1ae161b8651dc378f4fa085626645964e31501c548cf478f2a64979fdb689fc9
MD5 a5547b3ca72f57b5d84e2abf32e02463
SHA1 c61ef9fcb3786336ed33dced8160186a2df33f7d
SHA512 a76558126a65c2765d7e72221c595c16e682d0e6116b72a9d8e2d9dd35382a9130daeb5234d962a3c271aa43c769c459c2da929135a93dc06ab3971f2e3848d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 570c8b159bbfd2a65e36b332d5e8087e36ff13173fd77527a57c77740f4c1c2f
MD5 6ff4baa53890ed8fe8b2139865882ac9
SHA1 5e34df8ef5aa183869aaea347d092d16c84e6cba
SHA512 ff6844044e84de9f8e831ae617e573a31f6f2e999cd907533e73cce844811143ce3e7e3bf0815d1d01d46a98548ca009bc7aec205b0ef45624bf88694b15b4d5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a3c0ada2bca71597ff5442c525ca27702d48586eac79625cc35e1363e7a4c7be
MD5 a880c13eaccd2d8f132cca56bbd37b75
SHA1 36b8deeb1b6642c90c39ecd4a12cd731f741d1b9
SHA512 9312b90a6093c736099a11999b4e8cf1b961bf84927f89c7bf7fde23a02ca34ad44b0520cc3b29d1c5d65de68a491d8a44a48fa4dfdbc948cc764b540926ffd1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 67ab86a69db7208488cedbf88357d606b896a1bbe78bdb68050bc54a23022d08
MD5 4c1409eab97bc1b8fffe38682211d8fb
SHA1 5470efa8e3db1e25b72a5d51b967e7728ffad4b3
SHA512 50b23535900f7b47b57cb1da0186c7fae9578f11e766960e181f1fe0464eb1b23f5ca186d0104549e863ac8230b5067a71679a3cbcefb548a82d25446a3ce48a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5a0e5361921227002309fdd0195a9a70a858505be3f730fc38235f1a0b095633
MD5 31ec269ccc574c3b37195fd6d4d15df6
SHA1 ab7226d929708b79de8d839999c663b28f8de676
SHA512 719354c4f30bf58751945350dfe6718a90a84c11cdf41ef66753dafa68e2da078d8c0a7f7a6c9591b6592542cea691dcbceb3fa74752e83bd6ecc5bd71421ac8
MD5 SHA1 SHA512

Submit Download

svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAABBCCCBABCACBABBAAAACAACBCABBCBBBBCCAAACAAACCAA.exe
Size 12.4MB
SHA256 c1d5eb18becf0ac8168a30e4bf78cfdf83395624a7e45fe92c5eaa37613fcc5c
MD5 fd5e1ff8a3f829beb3247e92b5f82022
SHA1 3e0f6eafe4995c2518fdb3149410894f51c712ba
SHA512 793a970a4c5088d1885a92aa9e8a0ef5423460caba123bc37450adb269aa5d90f581e27bbcb9568d43a3a9336785fb7e298dc196b42579c741e70d528da5647a
SSDEEP 49152:U+ES+Ed+ES+EZDiw2J+ES+Ed+ES+EZDiw2J+ES+Ed+ES+EZDiw2J+ES+Ed+ES+ER:G/fh6ImzzJoDfuBcMv+A73XAM
TLSH
T1B6D64A05FADF44B4E573623049A7827F9632B9118731CADFE2848B2E9D63BD09D35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-86-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/240-22-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/240-60-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/240-11-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/240-0-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/240-34-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/1468-88-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/3900-51-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/3900-72-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/3900-41-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/3900-33-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/4656-95-0x0000000000410000-0x0000000000431000-memory.dmp

Download