b98b2628168998b6bc050219f6358b7c4e32b06b16a42738553ee7172674e7f3

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_d68e9509655d068d27b37cc4a2a3d7f8_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
Size 47.1MB
Sample260831-rfdckagh47
SHA256 b98b2628168998b6bc050219f6358b7c4e32b06b16a42738553ee7172674e7f3
MD5 d68e9509655d068d27b37cc4a2a3d7f8
SHA1 732e6f63fc2899b70c3939b2db4bd574c9acd26a
SHA512 108767a4d35620d5f1e9918cb8acb9ea0db6ac6b46f8677c7b01dd3587d4cf0a93b1d7acbf21e32107d1a1843f98288681535bb0d87e5fb47b0e381d4bb06ccd
SSDEEP 196608:HKWQc0gEYnvLfKWQc0gEYnvLfKWQc0gEYnvLfKWQc0gEYnvLBHh6ImzD+FU:OcZEIv6cZEIv6cZEIv6cZEIvQX
TLSH
T15FB75D09FD4340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4DCB5BA523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5392	svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe
1996	svchost_BACABACBCBACCBCCCCCBBCCAACBACAABACCCACACAAACCCBCBCCCCCB.exe
3860	svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCACCBAAAACACAAAAAACBBABCABCCCABACBAABACBAABAAACAAABBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe"	2026-08-31_d68e9509655d068d27b37cc4a2a3d7f8_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCCACBCAABABCBCAAACBBBBCABCBACBCAAABBBAAACBCCBAABAAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACABACBCBACCBCCCCCBBCCAACBACAABACCCACACAAACCCBCBCCCCCB.exe"	svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2640	sc.exe
2148	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
964	cmd.exe
1364	cmd.exe
2568	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACABACBCBACCBCCCCCBBCCAACBACAABACCCACACAAACCCBCBCCCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_d68e9509655d068d27b37cc4a2a3d7f8_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5812	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4588	2026-08-31_d68e9509655d068d27b37cc4a2a3d7f8_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
4588	2026-08-31_d68e9509655d068d27b37cc4a2a3d7f8_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
4588	2026-08-31_d68e9509655d068d27b37cc4a2a3d7f8_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
4588	2026-08-31_d68e9509655d068d27b37cc4a2a3d7f8_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
5392	svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe
5392	svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe
5392	svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe
5392	svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe
1996	svchost_BACABACBCBACCBCCCCCBBCCAACBACAABACCCACACAAACCCBCBCCCCCB.exe
1996	svchost_BACABACBCBACCBCCCCCBBCCAACBACAABACCCACACAAACCCBCBCCCCCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4588	2026-08-31_d68e9509655d068d27b37cc4a2a3d7f8_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
Token: SeDebugPrivilege	5392	svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe
Token: SeDebugPrivilege	1996	svchost_BACABACBCBACCBCCCCCBBCCAACBACAABACCCACACAAACCCBCBCCCCCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 964	4588	2026-08-31_d68e9509655d068d27b37cc4a2a3d7f8_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe	92
PID 964 wrote to memory of 5812	964	cmd.exe	94
PID 5392 wrote to memory of 4540	5392	svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe	95
PID 4588 wrote to memory of 1364	4588	2026-08-31_d68e9509655d068d27b37cc4a2a3d7f8_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe	98
PID 1364 wrote to memory of 2640	1364	cmd.exe	100
PID 4588 wrote to memory of 2568	4588	2026-08-31_d68e9509655d068d27b37cc4a2a3d7f8_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe	101
PID 2568 wrote to memory of 2148	2568	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-31_d68e9509655d068d27b37cc4a2a3d7f8_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_d68e9509655d068d27b37cc4a2a3d7f8_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCCBCBBACBCABABBABAABBAAABAACBACBAABCCCBBBCCAAACBBAACBCABABBCABCCAAAACCAAACABBAAABACCACBCABBABCCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCCBCBBACBCABABBABAABBAAABAACBACBAABCCCBBBCCAAACBBAACBCABABBCABCCAAAACCAAACABBAAABACCACBCABBABCCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCBACACACABACCACBBBBACABBCCAAABBCCACBBCCACACCBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe" start= auto displayName= "UserDataSvc_AABCBACACACABACCACBBBBACABBCCAAABBCCACBBCCACACCBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCBACACACABACCACBBBBACABBCCAAABBCCACBBCCACACCBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe" start= auto displayName= "UserDataSvc_AABCBACACACABACCACBBBBACABBCCAAABBCCACBBCCACACCBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCBACACACABACCACBBBBACABBCCAAABBCCACBBCCACACCBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCBACACACABACCACBBBBACABBCCAAABBCCACBBCCACACCBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACBCBACCBCCCCCBBCCAACBACAABACCCACACAAACCCBCBCCCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACBCBACCBCCCCCBBCCAACBACAABACCCACACAAACCCBCBCCCCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe
1⤵
- Executes dropped EXE
PID:3860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 73a4d5fd0652297dac6259195863e5aa8a03ce6b2f84e7660e99f113c69e9c69
MD5 07a9c593c935a7f5ca0a4cf375d6cdd2
SHA1 6cb78b36c52079a8b8e0535a3fafb8a158f8ad0d
SHA512 c11e493bc0848257425848ba13b1d3472872e73f19ddad4ba085aba58258ff9320b7072092ee904bccde653cd94d8ac52df6b90882001e2ee0b6431a1ca770dc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 44672593f89dbcc1db576a125029b4b81f3ad2828afd740f6e0c40bf0d13f76e
MD5 ff5e19bc00f5fcd43951bb85829ab592
SHA1 01b76a84f8a6ab61e8e11aa4fe87bc9bc803371e
SHA512 d33163abcec8c331c9055207a83040742092261f1d1d85b1b6ebe2ff782e954340579bf0161de8d2e1bb9bfa2da871080f16846593c4387e42a819668bad42ab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3faa705b16801670a3f63a6fc1b24bbaa66696d4f8fca34bb1ed43c5127b4d36
MD5 c096af96265761fd03e9d031619bf297
SHA1 43798d15b844694cb171940b9347a0dd77ba4551
SHA512 bac452d9075c835fa894f18e4184d96ef5ef3c5ff058f83ff1b8c15760bd9e205c264f657ff1457d04adda1b8cc80d5eb83bf5d6708a659d1237d68d2ec76b14
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c2c6ee6b64273af82d71db92b9e7b52217693f7a855b5fb0ccb931d91e3351da
MD5 be32d6f9ce1f40241cd4ce4d028d7c4f
SHA1 3bad721ad3ce5689e74cefe6d3c11e28d27c596a
SHA512 6ac053b4f4bf0525c81855238435c3300d6c7109d2f3ec333be83e257ead55e098a96514e76fe3ee09a6482968cdbcf50e2d00367427a44ee763224b1df1cd7f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7c5116fc1549be686e8f0a6875c9cc226ba79fcb29f50f9e1aadc0cf1cf9266c
MD5 d7e7605d5d76de8576b9c2b8db9f321d
SHA1 1f5c7ee0142ad4c9992c0c8d30e5bed68d8445d9
SHA512 446a39758bedbc2a85d80bab7ef61fa59e8712aa3e8a2646eeba540c332fe676854f5ca4a0c66fd15c70bf43e0e902239022ffbb1f2e6b122730eb4e40505b07
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 23d67098f8573d1d999032a11f335a531be8706f53a296ff27ec1ec9a3dd94fb
MD5 58c831d58f2cfe11550b44b5649ce0f4
SHA1 d96f832fcc5439c1e95a7d2ba373d9548ce7bcf6
SHA512 0f718084c46ac1a71720b4eb6534aebc4c81dae70bbe2572e02661403091cf8f78cbb236dfaa78553315f560b55963c8b3017849bc62a405483d5133cc245079
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 896cc270c10d9b6f87655bbad460500c9f11837e3ec386128f33d48e10b138dd
MD5 9b7c397c87c28db91b3253d8c710d5f2
SHA1 cf126ec22bdd86231d8bb3811391140fde7e1a52
SHA512 4a557ca6e0b5441f784c285b063d87fa4b06913c4a3647645c8005297a2e647f776e7706d948d960a6b0d39ac9730cecaefe7f538e418c73b52d596442b4c158
MD5 SHA1 SHA512

Submit Download

svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBACBCCBABCCCCACCBBCBABBBBCBABAACBBBCACBABACABCCAC.exe
Size 47.1MB
SHA256 b98b2628168998b6bc050219f6358b7c4e32b06b16a42738553ee7172674e7f3
MD5 d68e9509655d068d27b37cc4a2a3d7f8
SHA1 732e6f63fc2899b70c3939b2db4bd574c9acd26a
SHA512 108767a4d35620d5f1e9918cb8acb9ea0db6ac6b46f8677c7b01dd3587d4cf0a93b1d7acbf21e32107d1a1843f98288681535bb0d87e5fb47b0e381d4bb06ccd
SSDEEP 196608:HKWQc0gEYnvLfKWQc0gEYnvLfKWQc0gEYnvLfKWQc0gEYnvLBHh6ImzD+FU:OcZEIv6cZEIv6cZEIv6cZEIvQX
TLSH
T15FB75D09FD4340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4DCB5BA523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 129b52a200738b2831b5eee94f67517c735beb143dea4f1cd58641b70a274b11
MD5 890d08f751050ea3698fc1f2961a7551
SHA1 b5d779df483f475c32240b6e55ddba3a5f2900d3
SHA512 b6ffd185ffa42f586b8dcce5aab416ac427d624b3047f5d539c40c9fabfc1999732b0f701041b78c477d1082292c42f4f412104e018a0b36e9aa9c1c72186a7c
TLSH
T11011E351F0F598A3F53328CF8225AA971CD8379FA8186A15331D821D6F99C32DE150E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1996-69-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/3860-74-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/4588-7-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/4588-0-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/5392-33-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download