b53e951db5a29607bcae2a69c405ba346466612cf53267c8c7aa942fc8eb585f

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_739a7d5db82b5c0728e1a03f5e526490_coinminer_cryptbot_elex_glassworm_poet-rat_vidar_wannacry.exe
Size 16.7MB
Sample260905-3c7msavbka
SHA256 b53e951db5a29607bcae2a69c405ba346466612cf53267c8c7aa942fc8eb585f
MD5 739a7d5db82b5c0728e1a03f5e526490
SHA1 739abda2a23563b3527ff97e14b01cade397bc93
SHA512 33f716075440107f4520e704f8b8f5f789f175ebaf1f9a01ebfbd86d1cb8558344f5206e907c1ddb2f85151a5e6d9a33f76c8528f8399e0fd413337870ab6325
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Eoiw2K+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+K:1/fh6ImzzJoDfuBcMv+A73XA
TLSH
T19E075D09F98744B1E92B517008DBD3BF8671BA158332CEEBE749CB2FA923B915835315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2176	svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe
1220	svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe
1264	svchost_CAAACCACACAABBCBAACAAAACCCBABBCCBBACBBCBCACACCABAAAAABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCAABABCBBCAABCACBBBBABABCCBCCACCABCBBBBACCCACCBAACBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe"	2026-09-03_739a7d5db82b5c0728e1a03f5e526490_coinminer_cryptbot_elex_glassworm_poet-rat_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABAAACBAAABBBACBAABBBBCBCBBAAAAACBCACCBABACBBBAABABACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAACCACACAABBCBAACAAAACCCBABBCCBBACBBCBCACACCABAAAAABC.exe"	svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2908	sc.exe
4464	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
248	cmd.exe
2180	cmd.exe
3012	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAACCACACAABBCBAACAAAACCCBABBCCBBACBBCBCACACCABAAAAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_739a7d5db82b5c0728e1a03f5e526490_coinminer_cryptbot_elex_glassworm_poet-rat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2248	2026-09-03_739a7d5db82b5c0728e1a03f5e526490_coinminer_cryptbot_elex_glassworm_poet-rat_vidar_wannacry.exe
2248	2026-09-03_739a7d5db82b5c0728e1a03f5e526490_coinminer_cryptbot_elex_glassworm_poet-rat_vidar_wannacry.exe
2248	2026-09-03_739a7d5db82b5c0728e1a03f5e526490_coinminer_cryptbot_elex_glassworm_poet-rat_vidar_wannacry.exe
2248	2026-09-03_739a7d5db82b5c0728e1a03f5e526490_coinminer_cryptbot_elex_glassworm_poet-rat_vidar_wannacry.exe
2176	svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe
2176	svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe
2176	svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe
2176	svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	2026-09-03_739a7d5db82b5c0728e1a03f5e526490_coinminer_cryptbot_elex_glassworm_poet-rat_vidar_wannacry.exe
Token: SeDebugPrivilege	2176	svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 248	2248	2026-09-03_739a7d5db82b5c0728e1a03f5e526490_coinminer_cryptbot_elex_glassworm_poet-rat_vidar_wannacry.exe	91
PID 248 wrote to memory of 1140	248	cmd.exe	93
PID 2176 wrote to memory of 2572	2176	svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe	94
PID 2248 wrote to memory of 2180	2248	2026-09-03_739a7d5db82b5c0728e1a03f5e526490_coinminer_cryptbot_elex_glassworm_poet-rat_vidar_wannacry.exe	95
PID 2180 wrote to memory of 2908	2180	cmd.exe	97
PID 2248 wrote to memory of 3012	2248	2026-09-03_739a7d5db82b5c0728e1a03f5e526490_coinminer_cryptbot_elex_glassworm_poet-rat_vidar_wannacry.exe	98
PID 3012 wrote to memory of 4464	3012	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-09-03_739a7d5db82b5c0728e1a03f5e526490_coinminer_cryptbot_elex_glassworm_poet-rat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_739a7d5db82b5c0728e1a03f5e526490_coinminer_cryptbot_elex_glassworm_poet-rat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBACACACAABBAAAAAAACCCCCABBACCABBBAABACBAABBBCCACACAAABCBCABABBAAAAABCBBCACBABCCABBBABAACCCCBCBCBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBACACACAABBAAAAAAACCCCCABBACCABBBAABACBAABBBCCACACAAABCBCABABBAAAAABCBBCACBABCCABBBABAACCCCBCBCBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBBCACBABBABACAABBBBCACAACBBAACCBACCBCCBABBBBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe" start= auto displayName= "UserDataSvc_BCCBBCACBABBABACAABBBBCACAACBBAACCBACCBCCBABBBBAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBBCACBABBABACAABBBBCACAACBBAACCBACCBCCBABBBBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe" start= auto displayName= "UserDataSvc_BCCBBCACBABBABACAABBBBCACAACBBAACCBACCBCCBABBBBAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBBCACBABBABACAABBBBCACAACBBAACCBACCBCCBABBBBAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBBCACBABBABACAABBBBCACAACBBAACCBACCBCCBABBBBAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe
1⤵
- Executes dropped EXE
PID:1220

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACCACACAABBCBAACAAAACCCBABBCCBBACBBCBCACACCABAAAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACCACACAABBCBAACAAAACCCBABBCCBBACBBCBCACACCABAAAAABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a74e3c060a2b8ebf5a64c500e32dfa3fd072142a4098676227fa212dac55fed5
MD5 ec2cadf8623339d31c69e41c22b08d1a
SHA1 06e209c2634fb9562b863861de4d99f50d4006f6
SHA512 6d5ccc3aa2b9a00814703bce05ff723e00cc7878526c641186b09ea73a4288b40b39852fac053d9089070d91801b5fcbcd8c556f9d5cc71ebae7ab8353d62dd0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dac8362fa47448563a549957dee0a101d6b6290ab99e63996bf05306b3a9c89f
MD5 ffb2a7d91493c5e96934462805d53f27
SHA1 2b2cc65b6bda8a058157fc5c35fbf13195be6a38
SHA512 b00fd62f7e67036550b62d64b67b07ff399c1ff4d94798a35e571818dac7466f88a5ac9b1e3fd6bfb8a575bffe5c947023347677cad7074294354a3a697f8bfb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9f4278c2ac46cd0b9c5508ffc0a83530132803b4530bcb364dcd5b9741485aa4
MD5 325f9ba5ba47d1a74013b9aedb832dd2
SHA1 6129e5a297d8607a5edb475932fec2b6cb4054de
SHA512 0b8aac72f3aa53329e8f412b6870fe60cf39de40af086d4f727db10399bcf8380328af408788340e81a235bb65e11111e5883c1cef490704f37ddfd1d6a00d56
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b42da760f9f67f8d0eaf1ecaddeee293f1a4e4be1d2f0404fbf9b9b3186f0303
MD5 38253e078c8f6c1bfd6c8b41f9b203ea
SHA1 d820b0cdc4cc34dc8ddd868aa45be5e86387a67b
SHA512 a4a9dc8dcafb5629f202366db2c262bfa73c6fa480e2696c7bc3a11ef3998b2b3b7b6279a2ec91c0586cf2aa69d651aaab64273e1845124df7db14dd5f73e37f
MD5 SHA1 SHA512

Submit Download

UseCompare.exe

Path C:\Users\Admin\Downloads\UseCompare.exe
Size 50.5MB
SHA256 ccb409d381a9dde2bc0d92771c2c12584647b0a05c0aa86bbf2337d2db387d61
MD5 9e5139df9567e7c17dc8de707feb95a7
SHA1 66b741fede64cdabcd4f48dbb51139b068a57f3f
SHA512 ce77e55667bfe3e062da231c473c049f270da6505589c1ce38384998fca06238d433ebe0d6492ae2bc74a364a91ea14ea823427f5d629b8c8d5d143fd23c7add
SSDEEP 196608:1Hh6ImzD+FVHh6ImzD+FVHh6ImzD+FmmRk:ILLD6k
TLSH
T1BAC76D09F98744B1E92B517008DBD3BF8671BA158332CEEBE749CB2FA923B915835315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCABCBACBABCCACBCBAABAAAABCBACAABCAACCCABABACACBBCBAA.exe
Size 16.7MB
SHA256 b53e951db5a29607bcae2a69c405ba346466612cf53267c8c7aa942fc8eb585f
MD5 739a7d5db82b5c0728e1a03f5e526490
SHA1 739abda2a23563b3527ff97e14b01cade397bc93
SHA512 33f716075440107f4520e704f8b8f5f789f175ebaf1f9a01ebfbd86d1cb8558344f5206e907c1ddb2f85151a5e6d9a33f76c8528f8399e0fd413337870ab6325
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Eoiw2K+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+K:1/fh6ImzzJoDfuBcMv+A73XA
TLSH
T19E075D09F98744B1E92B517008DBD3BF8671BA158332CEEBE749CB2FA923B915835315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2176-34-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/2176-52-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/2176-73-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/2248-0-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/2248-33-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/2248-59-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/2248-22-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/2248-11-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/2248-80-0x0000000000250000-0x0000000000271000-memory.dmp

Download