36e1a9f6a87049408cb1c9d0d71540dcf76ec2d43eb67522f6544cb99df57147

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_f5d8329c474cbfc5dac9840a3b35fb71_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
Size 8.7MB
Sample260903-w96y7adr21
SHA256 36e1a9f6a87049408cb1c9d0d71540dcf76ec2d43eb67522f6544cb99df57147
MD5 f5d8329c474cbfc5dac9840a3b35fb71
SHA1 e4a345332eb54fe824bce1b8e91de6ee639e0f1a
SHA512 20e1080bbfacb858bb4a23007c0d584603a0da9332d2300c4cbee431db2f3943636d3a1a65802d4c1be01276c400d0efb8b11fc54e0ece2dd4b8319da82d0589
SSDEEP 98304:p/fh6ImzzJoDfuBcMv+A73XAJ/fh6ImzzJoDfuBcMv+A73XAZp7I:pHh6ImzD+FJHh6ImzD+F/I
TLSH
T184966B50FEDB94F5EA035A3049A7A37F6330A9098735CBC3C7405FA6E957AD21A33216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5620	svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe
4312	svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe
6100	svchost_CBAABCBBABAABCABBBACACCBCCCCCABAABBBACCACBBAACACBACACCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACCCCBACACBCBCBACBBBBABCABABBCABBBACBBBBBABACBCABAABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe"	2026-09-03_f5d8329c474cbfc5dac9840a3b35fb71_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABABABCBACCABBBCBACBBCCBCABAABCACBAAAABCCCACCBACABABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAABCBBABAABCABBBACACCBCCCCCABAABBBACCACBBAACACBACACCB.exe"	svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4756	sc.exe
4828	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5368	cmd.exe
5584	cmd.exe
4688	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAABCBBABAABCABBBACACCBCCCCCABAABBBACCACBBAACACBACACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_f5d8329c474cbfc5dac9840a3b35fb71_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1340	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1016	2026-09-03_f5d8329c474cbfc5dac9840a3b35fb71_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
1016	2026-09-03_f5d8329c474cbfc5dac9840a3b35fb71_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
1016	2026-09-03_f5d8329c474cbfc5dac9840a3b35fb71_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
1016	2026-09-03_f5d8329c474cbfc5dac9840a3b35fb71_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
5620	svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe
5620	svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe
5620	svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe
5620	svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1016	2026-09-03_f5d8329c474cbfc5dac9840a3b35fb71_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
Token: SeDebugPrivilege	5620	svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 5368	1016	2026-09-03_f5d8329c474cbfc5dac9840a3b35fb71_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe	91
PID 5368 wrote to memory of 1340	5368	cmd.exe	93
PID 5620 wrote to memory of 5124	5620	svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe	94
PID 1016 wrote to memory of 5584	1016	2026-09-03_f5d8329c474cbfc5dac9840a3b35fb71_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe	95
PID 5584 wrote to memory of 4756	5584	cmd.exe	97
PID 1016 wrote to memory of 4688	1016	2026-09-03_f5d8329c474cbfc5dac9840a3b35fb71_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe	98
PID 4688 wrote to memory of 4828	4688	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-09-03_f5d8329c474cbfc5dac9840a3b35fb71_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_f5d8329c474cbfc5dac9840a3b35fb71_cobalt-strike_coinminer_cryptbot_darkgate_elex_glassworm_poet-rat_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCACABBACBACACACBBCABCBACACACCABCCBBABAACBABAAACAAAACCCBAAAABBAABABCCABBBCABBABCCCAACCBACBBABBBCABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCACABBACBACACACBBCABCBACACACCABCCBBABAACBABAAACAAAACCCBAAAABBAABABCCABBBCABBABCCCAACCBACBBABBBCABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABBAABBCAABACBABACABABBCBCBCBACBCACBBAAAACBBCABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe" start= auto displayName= "UserDataSvc_CAABBAABBCAABACBABACABABBCBCBCBACBCACBBAAAACBBCABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5584
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABBAABBCAABACBABACABABBCBCBCBACBCACBBAAAACBBCABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe" start= auto displayName= "UserDataSvc_CAABBAABBCAABACBABACABABBCBCBCBACBCACBBAAAACBBCABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABBAABBCAABACBABACABABBCBCBCBACBCACBBAAAACBBCABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABBAABBCAABACBABACABABBCBCBCBACBCACBBAAAACBBCABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5620
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5124

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe
1⤵
- Executes dropped EXE
PID:4312

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCBBABAABCABBBACACCBCCCCCABAABBBACCACBBAACACBACACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCBBABAABCABBBACACCBCCCCCABAABBBACCACBBAACACBACACCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 35c20c2e1d2871f79052f612a907d7b33891defd9598963d5a6914e51d805b44
MD5 f912e6e0682b2313ade041d7f1ab9d84
SHA1 7eb190e7647927f8c87900e07dec7cc16a0f130f
SHA512 ad373e8f2cb10462b82f762d23677dac877d97115df28309d1106c2042964feb7f3ee4f1022b51c5219ce17c79b2c8cb20cb8758e77455543ce19df2c56a5d40
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 985e0d681d43ecf03e43c8d2a6cee50ffa307a229f26230912da0a106437e3bb
MD5 a04a9df7c5bf2453342ea166c6d2a7e2
SHA1 abfa411772db6b18041883922acc9fa86947fdcc
SHA512 998458f36f6c050b08da5e8fd4f29ce7aadfde21f92097a9a39b66fd5a88b4c883ee719b327be9f76eb014f11b415c7f67b73002d8669daff355cd7388ad3716
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 72753f66b18da12074b660c53b055b3ea002ec89d230d435d5955672f00758e9
MD5 434d290f1351cae1a1611f1e74458fdb
SHA1 b54a5ff97b1260a13320e906b2188a7b536ecd4f
SHA512 2c5d65de592089821298e1cc6b325efd447cd0d89a2a8a30075a9ea060b0cfe7512350b29042a429e3be9a4b4957aa7ea864a691128b8efd59abd38e7f78ee7f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c8bc48a711d497ae0e971fe7eeec331ca953f8e45f1038a9620176af22d3bdff
MD5 910b23219baa9adf0db92f1b27bc014a
SHA1 357605768378646fe2ef7b63c8f6e3780f70a39e
SHA512 107858f1c194d2d40a64d71a2c6f9bd1fada8a8f27783363eb672ef73e683d25543245d2dce5b342d1cc4354fa85e926cd9700380f1ece8bf6384a46333e6b64
MD5 SHA1 SHA512

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 576KB
SHA256 63ce391cfb0eae75224c8584f307252e6889a1b7d1c0bd930fd09a923ab1f80d
MD5 b153e1a81ae1aae8d59da10c1a27d24e
SHA1 cb16489ab43a1338a87f9ac4d161b185dcaa0e7d
SHA512 663c01747515de055ffff49abb049ca25af330cd75b71d5d7ddf63bb50c416d4852bce1ee5cbdb72fbc27c8cae69e445ea72404c3814bce688d666a745428e83
SSDEEP 12288:mgUFgEsnojAn+BeDuUlXfFm9aZP4K8h1FEks5M4suHq0+TPJe:m9+EM0iE4m9aZP4K8BEks5M47HP+TPJe
TLSH
T185C419A4EDEF50F1DA0B4470895B937F66323B094F34DDCBD3841B5ADA23AE21136629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 1.6MB
SHA256 f08c26c9eeda19c19717ddeb78790c1e350d0310aa090614bd44b286c21218d8
MD5 aa1203cddf624895281230773f097db5
SHA1 0c8c3b8823c385f2d2979cd9c190d48a87b03c02
SHA512 095d130ed99def149da07a5d00f1799afb146d68569ec11fd95aa650c58c46643b7e9bab2328b1997de6eba885345e6cdae16cfcd985da1c33c04ae10bfc8789
SSDEEP 49152:U+EMKKfHPZ6IVMv76K8ocsCGzzJ7UDv7f:p/fh6ImzzJoDz
TLSH
T1A97509A0EAEF50F5EA039870555BA23F96313B098738DEC7D7801F82E567AD3153352A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9a19e0a3b8b3d62361f3033a1d213d01610c53f1a2eb3265b8681aa9b676cffb
MD5 29b0575cbb4365108d3764f954074586
SHA1 3c154dab1d93bdefa0ced9efc128fb210ad7050d
SHA512 a20de29199168a7a0798507114da286ad0ff1541df621329a38e9565dbfe7a6f000c62e12ad389adddd8d19929310d1ab6023471cf0be342a59f856c06c39938
MD5 SHA1 SHA512

Submit Download

svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCCCAAACACBBBCCACBBCBCABBBCBCACAABBCABABABACCCBBBCCC.exe
Size 8.7MB
SHA256 36e1a9f6a87049408cb1c9d0d71540dcf76ec2d43eb67522f6544cb99df57147
MD5 f5d8329c474cbfc5dac9840a3b35fb71
SHA1 e4a345332eb54fe824bce1b8e91de6ee639e0f1a
SHA512 20e1080bbfacb858bb4a23007c0d584603a0da9332d2300c4cbee431db2f3943636d3a1a65802d4c1be01276c400d0efb8b11fc54e0ece2dd4b8319da82d0589
SSDEEP 98304:p/fh6ImzzJoDfuBcMv+A73XAJ/fh6ImzzJoDfuBcMv+A73XAZp7I:pHh6ImzD+FJHh6ImzD+F/I
TLSH
T184966B50FEDB94F5EA035A3049A7A37F6330A9098735CBC3C7405FA6E957AD21A33216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1016-22-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/1016-34-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/1016-0-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/1016-60-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/1016-11-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/1016-86-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/4312-93-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/5620-51-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/5620-72-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/5620-69-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/5620-47-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/5620-92-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/5620-33-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/6100-95-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download