87a00f58d5a459531bdc6366e0e54dc51ae4c037b33fa0875c12a3c76d0e4655

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_fdfa9e52f7af8add75cf8199e5fd5738_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 8.5MB
Sample260905-3y6bvabm21
SHA256 87a00f58d5a459531bdc6366e0e54dc51ae4c037b33fa0875c12a3c76d0e4655
MD5 fdfa9e52f7af8add75cf8199e5fd5738
SHA1 9cd20c5d548df34983838a480cbf656cb94aea7d
SHA512 08022511f6975272dde8ae3e55d75602561f3dcbb44dd83730eecd2f533a567d7b9af77b4d972b72636ebad2f07fe21f4f69c3f889118560bbfcdd69020551bd
SSDEEP 49152:U+ES+ES/iw2M+ES+ES/iw2M+ES+ES/iw2M+ES+ES/iw2M+ES+ES/iw2M+ES+ES/P:r/fh6ImzzJoDfuBcMv+A73XAe
TLSH
T1B8965B05FAEF44B0E963613049A7C37F9671B9018732CBDBD2448B2EAE23AE15D35716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2484	svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe
4080	svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBCCBABBABACBCABCCCCBCAABBBAAACCBAACACCBABBAABBBBCCBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe"	2026-09-05_fdfa9e52f7af8add75cf8199e5fd5738_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3100	sc.exe
2824	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2644	cmd.exe
840	cmd.exe
2328	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_fdfa9e52f7af8add75cf8199e5fd5738_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2692	2026-09-05_fdfa9e52f7af8add75cf8199e5fd5738_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2692	2026-09-05_fdfa9e52f7af8add75cf8199e5fd5738_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2692	2026-09-05_fdfa9e52f7af8add75cf8199e5fd5738_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2692	2026-09-05_fdfa9e52f7af8add75cf8199e5fd5738_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2484	svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe
2484	svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe
2484	svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe
2484	svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2692	2026-09-05_fdfa9e52f7af8add75cf8199e5fd5738_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	2484	svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 840	2692	2026-09-05_fdfa9e52f7af8add75cf8199e5fd5738_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	92
PID 840 wrote to memory of 4268	840	cmd.exe	94
PID 2484 wrote to memory of 4908	2484	svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe	95
PID 2692 wrote to memory of 2328	2692	2026-09-05_fdfa9e52f7af8add75cf8199e5fd5738_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	96
PID 2328 wrote to memory of 2824	2328	cmd.exe	98
PID 2692 wrote to memory of 2644	2692	2026-09-05_fdfa9e52f7af8add75cf8199e5fd5738_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	99
PID 2644 wrote to memory of 3100	2644	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-05_fdfa9e52f7af8add75cf8199e5fd5738_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_fdfa9e52f7af8add75cf8199e5fd5738_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACBCBCBBCAABCAACBCABCBCBCCABAACCBBCCAACACBBCCCCBBBCABBABABBAACBBABCCAAACAABCCCCABBCBCBBCBACCCABBBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACBCBCBBCAABCAACBCABCBCBCCABAACCBBCCAACACBBCCCCBBBCABBABABBAACBBABCCAAACAABCCCCABBCBCBBCBACCCABBBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBAABACBAAABBACBCABCBACBBBCBBCBCCCABCABABABCBCBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe" start= auto displayName= "UserDataSvc_ABBAABACBAAABBACBCABCBACBBBCBBCBCCCABCABABABCBCBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBAABACBAAABBACBCABCBACBBBCBBCBCCCABCABABABCBCBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe" start= auto displayName= "UserDataSvc_ABBAABACBAAABBACBCABCBACBBBCBBCBCCCABCABABABCBCBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBAABACBAAABBACBCABCBACBBBCBBCBCCCABCABABABCBCBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBAABACBAAABBACBCABCBACBBBCBBCBCCCABCABABABCBCBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe
1⤵
- Executes dropped EXE
PID:4080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 30ab9173064b65d668ccf43dd6debbbaa66c0f43095033bde31036165e4eec9d
MD5 8648ae700f422f5aba1d9cbf23f09329
SHA1 0522743daa1a3e7dce31939107692f8afb87229b
SHA512 d13ab5291b9f85af8c442ac8509e05b0a0a5c040d4ab9ffc2aa232494cfe1f6b00bf84327bc9a0bab673054fea524f6fd2ae829b7a9afa03049f5951e600c38b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7a63582bc969107188765c93da5ec0a96ed5784b8a97ed71a751cbfe5b1c0fc7
MD5 4d2d366cea706e3a1e86bfaa0be07be7
SHA1 4bc07ae6c29893825e2dba2e93386db87e2543d3
SHA512 4b2ba5f54a52ace64830c454576c8fd15347c8405325e75c866cf2a41c0dea96c8b2a2e306660697ac05806cc1ac37aa1aee01d0c7013036116ad215ea1aebeb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8df56b1acaae7d4031a88fb1d78fdff8510edd835ea0de5c315932e07b96325a
MD5 9d36e5be8ec64c9557be627314a8fd8e
SHA1 adf47c9fc7a01e8683ae53d3528b531be50e2e62
SHA512 2cdaea0741a03a5a24119a60bf0b98151d61ff8c00a1d1216ebb68b1e7fd08e8b38275ae81677c288e00f93748ea92a12ea63a38502f459767a62bcd9b8632f6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bdeb930025dca2d05506b30ee50af17f76a53cecd61c34d487adaf54a09a1d58
MD5 3970fc2c0d074127dc8646ee03c6cb21
SHA1 60e85ab493f3b240ad358d714fed87576d46c9f0
SHA512 5ad73645c88aadc39255b1a4e6bcdc93a6bbaa51430a2b0013e2601d6c844c4372083d575fa9ee269f2d213231d791943e5bfd5e6dcf986f9fbcc4b789ef33f1
MD5 SHA1 SHA512

Submit Download

svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCCACBBCAACBBACCCCCBCAABACBCABCAABBBCAACACBACBACCC.exe
Size 8.5MB
SHA256 87a00f58d5a459531bdc6366e0e54dc51ae4c037b33fa0875c12a3c76d0e4655
MD5 fdfa9e52f7af8add75cf8199e5fd5738
SHA1 9cd20c5d548df34983838a480cbf656cb94aea7d
SHA512 08022511f6975272dde8ae3e55d75602561f3dcbb44dd83730eecd2f533a567d7b9af77b4d972b72636ebad2f07fe21f4f69c3f889118560bbfcdd69020551bd
SSDEEP 49152:U+ES+ES/iw2M+ES+ES/iw2M+ES+ES/iw2M+ES+ES/iw2M+ES+ES/iw2M+ES+ES/P:r/fh6ImzzJoDfuBcMv+A73XAe
TLSH
T1B8965B05FAEF44B0E963613049A7C37F9671B9018732CBDBD2448B2EAE23AE15D35716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2484-24-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/2484-37-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/2692-0-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/2692-8-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download