25294d66d708a776ba90ae815f5580496281bbc92676afb9b75567308f43fdcb

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_74903c3b224d8fd772e5a127f76dabc7_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 12.8MB
Sample260903-lrvs4aep4s
SHA256 25294d66d708a776ba90ae815f5580496281bbc92676afb9b75567308f43fdcb
MD5 74903c3b224d8fd772e5a127f76dabc7
SHA1 21aa2877cfdb6a5e9de6b484228c5cd7a51921e9
SHA512 d70849712400453f5074129682b25aa1a4cf2bf52243934921bc1aefede900c1fb637cee370e19c8e19964a7e22e973310cd6bb5bb3bae400abfa2aa1e3cb176
SSDEEP 49152:U+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+ES+E6hOx+ES+Eg+ES+ES+Ef+Eg+ES+ES+Ew:M9999T/fh6ImzzJoDfuBcMv+A73XA6
TLSH
T192D67C04F98744F1E9270170489BD3BF9630BD158B22CAEBE688DB6FE933BD16835615
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
252	svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe
3936	svchost_BBCCBCCCABBBBABAACACBCAAAAACACAAABCBCACBCCCAACBBACCAACA.exe
1724	svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACACBABACABABAABABACAAABABCABCACCBAAABCAABBABBCABBACBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe"	2026-09-01_74903c3b224d8fd772e5a127f76dabc7_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCBBBACCBACAACCCABCABAACBBABCCACCCCBBACAACABBCBACBCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCBCCCABBBBABAACACBCAAAAACACAAABCBCACBCCCAACBBACCAACA.exe"	svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5368	sc.exe
4056	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5608	cmd.exe
2244	cmd.exe
4944	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_74903c3b224d8fd772e5a127f76dabc7_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCBCCCABBBBABAACACBCAAAAACACAAABCBCACBCCCAACBBACCAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3312	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
944	2026-09-01_74903c3b224d8fd772e5a127f76dabc7_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
944	2026-09-01_74903c3b224d8fd772e5a127f76dabc7_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
944	2026-09-01_74903c3b224d8fd772e5a127f76dabc7_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
944	2026-09-01_74903c3b224d8fd772e5a127f76dabc7_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
252	svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe
252	svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe
252	svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe
252	svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	944	2026-09-01_74903c3b224d8fd772e5a127f76dabc7_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	252	svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 5608	944	2026-09-01_74903c3b224d8fd772e5a127f76dabc7_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	91
PID 5608 wrote to memory of 3312	5608	cmd.exe	93
PID 252 wrote to memory of 2288	252	svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe	94
PID 944 wrote to memory of 2244	944	2026-09-01_74903c3b224d8fd772e5a127f76dabc7_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	97
PID 2244 wrote to memory of 4056	2244	cmd.exe	99
PID 944 wrote to memory of 4944	944	2026-09-01_74903c3b224d8fd772e5a127f76dabc7_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	100
PID 4944 wrote to memory of 5368	4944	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-01_74903c3b224d8fd772e5a127f76dabc7_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_74903c3b224d8fd772e5a127f76dabc7_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBCACBAABCBBCCCAABBACAACABAABCCBAABCCBCBAABABAAAABCBBCACBACBACACABABACBAABCBBCBAACBBABABBCCAAAABCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBCACBAABCBBCCCAABBACAACABAABCCBAABCCBCBAABABAAAABCBBCACBACBACACABABACBAABCBBCBAACBBABABBCCAAAABCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABCABAABABCBCBBBBABBBBBCCCBCCACABABABBCCBACABAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe" start= auto displayName= "UserDataSvc_AAABCABAABABCBCBBBBABBBBBCCCBCCACABABABBCCBACABAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABCABAABABCBCBBBBABBBBBCCCBCCACABABABBCCBACABAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe" start= auto displayName= "UserDataSvc_AAABCABAABABCBCBBBBABBBBBCCCBCCACABABABBCCBACABAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABCABAABABCBCBBBBABBBBBCCCBCCACABABABBCCBACABAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABCABAABABCBCBBBBABBBBBCCCBCCACABABABBCCBACABAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5368

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:252
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCCCABBBBABAACACBCAAAAACACAAABCBCACBCCCAACBBACCAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCCCABBBBABAACACBCAAAAACACAAABCBCACBCCCAACBBACCAACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe
1⤵
- Executes dropped EXE
PID:1724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a0e327be91cb66c8ed48f522d33382dac9725ca7dc1f5043af4f0cc10d6eb25e
MD5 40807f15c290f2c73e6df79bc7e32336
SHA1 be7ecdec5a2628c8e4b27a9c3d519d93b44d7a42
SHA512 de4b5beb902ebda2b4267134f2136e66f5265c019e6f208bd814ca0c51764cb0f79b8278044321627bb4c33b62300e340a2debf5ad81ca9ed5c168d033b3e3c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 edc453060aeee68bf5e206c0a942631e624e9a22481f3d42da6d78b619e828bd
MD5 9d5d279c53773f4c50c0df3c268b0fd7
SHA1 f67911fc23acee90e3c42f19038f01f3f0f74aaa
SHA512 a00e4859b4892c5b21af803dc8ed5128871c39a190b954f9417df42ff5d29b6fb78eb3c6cf60e7692561a9a9a1ab0498607bb8c91dd354143dbaeb20cbda5c8b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0fc8312ba90c6864ec9277f42f72cca71eebaead5ae07a3b5b02561f15ede90e
MD5 9a5be6953ca9cd99105a53a9ae038695
SHA1 3a1c714b17ab40740dfe737e2ccc55b348437ad7
SHA512 4fb3d98a78a05d79f9d4d1b5b61e643153d0730f01ad7af93b9ddeeb883e6e89ca0fd8c29129a65743af011351d86d9eb2f2034dad3c029dd3752d16f500bb0e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8555ccd9ddbdbd0fd6e96f4b00a2a4469ba474da85aed678602588d72b2728e0
MD5 d1b18b70859ad1364bce19b0f12f2617
SHA1 4c84da5a7649cc7ee5d4b3d6b15c8a8739cd16ba
SHA512 df846c3318a22e96aec61952e0f27751d48eb681a75b36de46ae72dcf3749e9c69196634ccb8e8edf62d98d143e5a0273545740604c8a6de1a63450398c031e5
MD5 SHA1 SHA512

Submit Download

svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCACCABBBBBAACCCACBCABBCACBBBBCABBACAACCCCBACBCB.exe
Size 12.8MB
SHA256 25294d66d708a776ba90ae815f5580496281bbc92676afb9b75567308f43fdcb
MD5 74903c3b224d8fd772e5a127f76dabc7
SHA1 21aa2877cfdb6a5e9de6b484228c5cd7a51921e9
SHA512 d70849712400453f5074129682b25aa1a4cf2bf52243934921bc1aefede900c1fb637cee370e19c8e19964a7e22e973310cd6bb5bb3bae400abfa2aa1e3cb176
SSDEEP 49152:U+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+ES+E6hOx+ES+Eg+ES+ES+Ef+Eg+ES+ES+Ew:M9999T/fh6ImzzJoDfuBcMv+A73XA6
TLSH
T192D67C04F98744F1E9270170489BD3BF9630BD158B22CAEBE688DB6FE933BD16835615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-24-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/252-34-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/944-0-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/944-8-0x0000000000840000-0x0000000000861000-memory.dmp

Download