a5c9468f51eb18a83f0b5ebd9a07eb2aa88e94afa89bd949653a7be2c389b7c2

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_abbb3c906422ad0110bfe48589a63995_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 12.1MB
Sample260831-te53asvgnh
SHA256 a5c9468f51eb18a83f0b5ebd9a07eb2aa88e94afa89bd949653a7be2c389b7c2
MD5 abbb3c906422ad0110bfe48589a63995
SHA1 6f6a5b8d99f426291c4b8a0d0438f3b50e3bace0
SHA512 0c34a76b6701dae35cebcbf58f62a186bd152e7728b36702bc35a96fd6664fd00905f67439579119e09043c148707a6bc3096592dd06fdde6cb339215aa3dc4b
SSDEEP 49152:U+Er6+EP+ES+EH+ES+EH+ErXiw2Y+Er6+EP+ES+EH+ES+EH+ErXiw2Y+Er6+EP+K:x/fh6ImzzJoDfuBcMv+A73XAx
TLSH
T17ED67C05FADB44B0E967117048A7D3BF8631B9118732CEDBE6488B2BAD33BE15835716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4384	svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe
2796	svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe
704	svchost_BCBBCAABABBBABCCABBCABBACACCACCCBACCABCBBBCACBBCABABBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABCAABACBCCCACCACBABCABABBBCABABCCAACBCCCAACCCBBAACAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe"	2026-08-31_abbb3c906422ad0110bfe48589a63995_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCCCAACAAACCAAABACBAACBABABBBCBCBACBABACCAABCCCACCCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBCAABABBBABCCABBCABBACACCACCCBACCABCBBBCACBBCABABBBB.exe"	svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2616	sc.exe
5792	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1356	cmd.exe
4848	cmd.exe
996	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBCAABABBBABCCABBCABBACACCACCCBACCABCBBBCACBBCABABBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_abbb3c906422ad0110bfe48589a63995_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4856	2026-08-31_abbb3c906422ad0110bfe48589a63995_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4856	2026-08-31_abbb3c906422ad0110bfe48589a63995_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4856	2026-08-31_abbb3c906422ad0110bfe48589a63995_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4856	2026-08-31_abbb3c906422ad0110bfe48589a63995_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4384	svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe
4384	svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe
4384	svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe
4384	svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe
704	svchost_BCBBCAABABBBABCCABBCABBACACCACCCBACCABCBBBCACBBCABABBBB.exe
704	svchost_BCBBCAABABBBABCCABBCABBACACCACCCBACCABCBBBCACBBCABABBBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	2026-08-31_abbb3c906422ad0110bfe48589a63995_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	4384	svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe
Token: SeDebugPrivilege	704	svchost_BCBBCAABABBBABCCABBCABBACACCACCCBACCABCBBBCACBBCABABBBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 1356	4856	2026-08-31_abbb3c906422ad0110bfe48589a63995_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	92
PID 1356 wrote to memory of 2204	1356	cmd.exe	94
PID 4856 wrote to memory of 4848	4856	2026-08-31_abbb3c906422ad0110bfe48589a63995_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	95
PID 4848 wrote to memory of 5792	4848	cmd.exe	97
PID 4856 wrote to memory of 996	4856	2026-08-31_abbb3c906422ad0110bfe48589a63995_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	98
PID 4384 wrote to memory of 2780	4384	svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe	100
PID 996 wrote to memory of 2616	996	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-31_abbb3c906422ad0110bfe48589a63995_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_abbb3c906422ad0110bfe48589a63995_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBBACCAABACBCAACCCBCABCBCCABBBCBBACABACACCACACBCBACBABCBCBCABCABABBABCCACBBABCCCCCACCBBABBACACCCABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBBACCAABACBCAACCCBCABCBCCABBBCBBACABACACCACACBCBACBABCBCBCABCABABBABCCACBBABCCCCCACCBBABBACACCCABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABBBCCBBCABABABABABBBBBABCBABCCCBACCCCABCACCACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe" start= auto displayName= "UserDataSvc_ABABBBCCBBCABABABABABBBBBABCBABCCCBACCCCABCACCACCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABABBBCCBBCABABABABABBBBBABCBABCCCBACCCCABCACCACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe" start= auto displayName= "UserDataSvc_ABABBBCCBBCABABABABABBBBBABCBABCCCBACCCCABCACCACCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABBBCCBBCABABABABABBBBBABCBABCCCBACCCCABCACCACCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABABBBCCBBCABABABABABBBBBABCBABCCCBACCCCABCACCACCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2616

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2780

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe
1⤵
- Executes dropped EXE
PID:2796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCAABABBBABCCABBCABBACACCACCCBACCABCBBBCACBBCABABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCAABABBBABCCABBCABBACACCACCCBACCABCBBBCACBBCABABBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 13f5548bff90f6ee110da182dba4740a33a8e8c9ea8fae44fde2245004e8290e
MD5 57ce031b81602f526c410b5691a389bc
SHA1 6bddc8412484642a1655e838caf260bdc29db2fa
SHA512 cb3c1774349df3fbfbff00ed48f3ecd62e787e770b5eb783b620e5d1f0860a6b45b33a7acce7b32ee2a10c17bb719b2d7a4a37772bb22a1624b7ab7e1aad60d5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 069f70904339e43663548066aaad3beb2785054f995605cf9c0d2e12ecdbb174
MD5 0813cd4576dce1b744add91dde07af1f
SHA1 b17168a351174dfecbaf561cab2676fd58d65334
SHA512 f8cb6168a40af7d4743903f6456722924983e24e1ac538a7c4fdc2d75bb305ffc7b9ce8efb7f6b9cec603fc86b2365d60b6436974ebaed1dd3ddef70b0fca443
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e8d86df65833dd08d029e5d97c61d69f1f3947f61b7a23fe1813e2d975319c76
MD5 069118d126b7acb9cd8bd9c89638104a
SHA1 feb3c82e5b759ead0eaa24caa234a521478ad7bf
SHA512 a6c24f3cf71aaea07e8c96bc0d106dbbefdac01f0104f7f731d2734d2a9ef651401f6ed5ba0172e1648de3eb21538b66d9960a427715c6170331bb20123e092b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4ea43d1e20854cb31cc1bd894a7545b8f6188e2f333cfc06afc9c4540dd49fea
MD5 d1ce1a01bd1c1a3c2eeef44729094068
SHA1 f815a52b8e4c51356baac68a8c24bad0e30bc299
SHA512 4eb0934b20b6ac215618551a6bf55a2f996abca8225c7f669f51d23493bf6f70c075e0f86521de5f167c845d89ef4679e86386ad46fc6730f8e3c99e21dbdb25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d43ba01040c37e1dab5b8c184f19507c86701d389e81755702f5b3099975727f
MD5 a4af33e6e4608e8bec3e75cd4832aa7d
SHA1 410220c7642d953e11d4befa4af8fb1b57fbfcbc
SHA512 ec50975172db5417bd0046b265850796ec5fe70efbb3df504c4ef25c35e65be4d468a240ae5477789946b1aa21fd7d5e647da3d9453c406e384aa742804e3563
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2d236858433b364a07d4fe22ad5393b75daf2966ed55a8bb07f4e3ed7d18e2fc
MD5 af2b30dfe2cd668ed97f5cf64b981b8e
SHA1 cc0970137cbdd6d2bcfac86957a34c390c2a6cec
SHA512 4d33f3728a335b9b592357b68d43ec03d5758e268f5486c873c0125dce24a73c99438392a715d3bc1084145da119f99a69eb0128906582771bc63d8e0047a357
MD5 SHA1 SHA512

Submit Download

svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABBCCCCAAAACCCCCBABCACBBACAAACAACCCBAACACBCCAAACBC.exe
Size 12.1MB
SHA256 a5c9468f51eb18a83f0b5ebd9a07eb2aa88e94afa89bd949653a7be2c389b7c2
MD5 abbb3c906422ad0110bfe48589a63995
SHA1 6f6a5b8d99f426291c4b8a0d0438f3b50e3bace0
SHA512 0c34a76b6701dae35cebcbf58f62a186bd152e7728b36702bc35a96fd6664fd00905f67439579119e09043c148707a6bc3096592dd06fdde6cb339215aa3dc4b
SSDEEP 49152:U+Er6+EP+ES+EH+ES+EH+ErXiw2Y+Er6+EP+ES+EH+ES+EH+ErXiw2Y+Er6+EP+K:x/fh6ImzzJoDfuBcMv+A73XAx
TLSH
T17ED67C05FADB44B0E967117048A7D3BF8631B9118732CEDBE6488B2BAD33BE15835716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7a9ad7f006d34c7f0c1dd278ee9d1d0668b0c15c83b2cfe2449824f6a16ec484
MD5 0be13a8457e0841f342d66d91738bef5
SHA1 34556e44c757eab87d768d9da4d07a5ed87e9213
SHA512 e260e2fef5026dbda472596f36c6c7dd547d748fe603543418d9f0686d75b6f60c78751e525b92125bd7f1cc6b9ef7000cecda52551ea06ef5b9116d79f10476
TLSH
T178112C61D1E6D8A3E432684F6639DDC70CED369EDC986E251315411CAFE5C318E198D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/704-81-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/2796-66-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/4384-35-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/4384-22-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/4856-6-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download