387536450fd9cf4564d43bf34a20951546cffe0e1dad51506128d9961bf4dd3a

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_05128b36eaa763461f72fddd9538ab86_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_i.exe
Size 54.1MB
Sample260901-161efsybrh
SHA256 387536450fd9cf4564d43bf34a20951546cffe0e1dad51506128d9961bf4dd3a
MD5 05128b36eaa763461f72fddd9538ab86
SHA1 90840fe891ff0f082dcc3defac49b824363b2f99
SHA512 238519418673872dda6cb59fe029dca9a9443416d0cca783964b290b2b8d6e0f9b1dade0788d8b4d15d94e96ba2c309d392fb3a6701d0f8d34fe09575daa78fb
SSDEEP 393216:rmHN6+Jrv8mHN6+Jrv8mHN6+Jrv8mHN6+Jrv8mHN6+JrvtB:abrVbrVbrVbrVbr1B
TLSH
T1E4C78C55F59720F9E46FD0B089ABC37AD6717C1341328B5BE66CCA572E23B606C28723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
7124	svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe
5668	svchost_ACBACBACCAABCACBBAAACCACCCCBBCBBCCCACCCCBACACBACACABCBA.exe
3112	svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCCCCABAACACBBAAABAACBBBBCBCCABAACBACCCBBAAACBAACABBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe"	2026-09-01_05128b36eaa763461f72fddd9538ab86_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_i.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAACCABBCBCCACCACCBCBBBACCCCBBAABCAAAACACBACABBAABCABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACBACCAABCACBBAAACCACCCCBBCBBCCCACCCCBACACBACACABCBA.exe"	svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6744	sc.exe
5644	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6708	cmd.exe
5800	cmd.exe
2584	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBACBACCAABCACBBAAACCACCCCBBCBBCCCACCCCBACACBACACABCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_05128b36eaa763461f72fddd9538ab86_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_i.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4716	2026-09-01_05128b36eaa763461f72fddd9538ab86_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_i.exe
4716	2026-09-01_05128b36eaa763461f72fddd9538ab86_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_i.exe
4716	2026-09-01_05128b36eaa763461f72fddd9538ab86_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_i.exe
4716	2026-09-01_05128b36eaa763461f72fddd9538ab86_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_i.exe
7124	svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe
7124	svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe
7124	svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe
7124	svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	2026-09-01_05128b36eaa763461f72fddd9538ab86_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_i.exe
Token: SeDebugPrivilege	7124	svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 5800	4716	2026-09-01_05128b36eaa763461f72fddd9538ab86_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_i.exe	91
PID 5800 wrote to memory of 2520	5800	cmd.exe	93
PID 7124 wrote to memory of 5328	7124	svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe	94
PID 4716 wrote to memory of 2584	4716	2026-09-01_05128b36eaa763461f72fddd9538ab86_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_i.exe	97
PID 2584 wrote to memory of 6744	2584	cmd.exe	99
PID 4716 wrote to memory of 6708	4716	2026-09-01_05128b36eaa763461f72fddd9538ab86_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_i.exe	100
PID 6708 wrote to memory of 5644	6708	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-01_05128b36eaa763461f72fddd9538ab86_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_i.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_05128b36eaa763461f72fddd9538ab86_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_i.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBBAACAAACBABAABBCACCCCAAACBABCBACCCACBCCABABACCCAABBBBCBBABBBCBABCBABCBBBCABCBBBCACAABBCCABCBACCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBBAACAAACBABAABBCACCCCAAACBABCBACCCACBCCABABACCCAABBBBCBBABBBCBABCBABCBBBCABCBBBCACAABBCCABCBACCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABACAAABAACACAABABAACBCABBAACCCCAAAACBAACBBCCACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe" start= auto displayName= "UserDataSvc_ABABACAAABAACACAABABAACBCABBAACCCCAAAACBAACBBCCACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABABACAAABAACACAABABAACBCABBAACCCCAAAACBAACBBCCACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe" start= auto displayName= "UserDataSvc_ABABACAAABAACACAABABAACBCABBAACCCCAAAACBAACBBCCACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABACAAABAACACAABABAACBCABBAACCCCAAAACBAACBBCCACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6708
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABABACAAABAACACAABABAACBCABBAACCCCAAAACBAACBBCCACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5644

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:7124
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5328

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBACCAABCACBBAAACCACCCCBBCBBCCCACCCCBACACBACACABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBACCAABCACBBAAACCACCCCBBCBBCCCACCCCBACACBACACABCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5668

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCABCAAABACBCBCBCABAAAACABCCCACAABABABABCBCABBABAABB.exe
1⤵
- Executes dropped EXE
PID:3112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 29ccb62f3fefa299cee49bb01d1621f220b4febe141b30471449fac13e5e27d5
MD5 f22de82d664e87629699ef3ea85a3aa2
SHA1 30e2056fb6e7be8105bba87e03fbb2a2f49dc3f5
SHA512 bfd8a109b368dd5aa77c72561253ea82cd700d993f0806a848b88affacb435a8abd68b5fea7820389ed7344f4dda3cae390c524deebe99ab91fc10e1239d2f21
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ac39d8e295c86e39de0b536b1ba85a22c698fe0284f37a64c90b4d4dc45e9aa3
MD5 152ef0cfe63dfdaf9c6ff31386cb19eb
SHA1 1a45e860e6256fc465d841d765f17645e4c6e8d7
SHA512 a05415095fa2345ed775e844f436ce777934ff1640f79f9e784b351751a393d62765266d4cae2b9cde14a701a827f2dbfd40b35f92b2222f8b35e9410c8648fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4d460116e8f74b9f5075bb0c223c06abd287716c0f2ee4affa45ce3258d1dd79
MD5 c6c4cba017b8ce6b6921fb1660a12e9f
SHA1 307ef26654ea1a434b3abcfefefe3a9ff1f2e991
SHA512 dd022d9926b0301931b434956c66aab3bc2c29a276beaf37d600212ecbe56a261bd2789effa8136442020d54b81d18a44a747393e2989bd914146d80a0e6c6ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e74f3ab6e03f116055e21849a8c22e88b06f75abd6221a8a34bc4c25327500ea
MD5 a376be69e54a55e6baf5863bc3808982
SHA1 77633b6967764767f0f7df459781ae03dd206f5f
SHA512 a2f99c4e3930595a24532198758eff935051aea21bbc29133e7c3b92458b7732d84b773c60b5edc1f955acaecd90332978da13be1c6569c9ab19d518561ea12e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 65c5148c1d3b5da3ceb1dc163ee28f9cceda41fdcfd371d6167fbb116a93cf8b
MD5 a90173ed2f1f5c6a37083ec5a02cba25
SHA1 2043571acbdd46e773a985c58b6f11b444c2082f
SHA512 5519402ef87e15cf0082e06a2f3ed7e4ad09d5ddad53654b657ae93ac2913848ede5c28ce3ad54ba964c2298fc8624d48c78fd511d027b2b8cf7e91c6a2b3428
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ccabd7668e29996e6a97dce72c71348062ec2f0b4ce8a637cc52c2f16537aaf9
MD5 bb6f1ec146d4d151fed6d2fe72884158
SHA1 67e0b45ef716df3c33213e2c3133bd721c7f8905
SHA512 110e415a14bb48bce790c4923719d31c27f79a5fb8f68a44c9d22caed7e49d3963c8eb7576ff205d125cb893eb6b0ba1278886ef0fe5342ed7d24c9078847ee1
MD5 SHA1 SHA512

Submit Download

memory/4716-0-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/4716-8-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/5668-65-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/7124-35-0x0000000000030000-0x0000000000051000-memory.dmp

Download