dfdb4eeda7b9a35343d6f8a254b6dd51d1e481efb99c811ee18c8e982b996626

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/09/2026, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_ac9c0c2fec442f9abb8b2afcb31d4d28_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Size 29.8MB
Sample260906-zaebnsdb86
SHA256 dfdb4eeda7b9a35343d6f8a254b6dd51d1e481efb99c811ee18c8e982b996626
MD5 ac9c0c2fec442f9abb8b2afcb31d4d28
SHA1 2662771733f4c6a4e945873fca9838f4881409a2
SHA512 9f0b6d08b3a9f531d482c06f95ebed8de17f5e6d390229d510b781c97d4568d4cfa5dd35cd6454cf9802e3233dd1b60bd3cedb5204c407fa5b0e22f065740d95
SSDEEP 196608:sHh6ImzD+FMHh6ImzD+FS1tIDewjqkjiqMc:z8X8Kwekyc
TLSH
T127676B18FA9780F1E967417048ABC2BFD6317D114B228BDBE684DB2EAE336D15C35721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
592	svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe
1224	svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe
1036	svchost_BCABBCABCCCCABACAACBBCACBAACCAABAABBAABACBACCBACAABCACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBACBABAAABCAAACCCBCAACCCBCCCBCBABCBACCCBABCBCBABBBACBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe"	2026-09-06_ac9c0c2fec442f9abb8b2afcb31d4d28_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCACCABABABBBBBBCACBCCACBACBBCCBACCAAAACAACCABACCBBCBBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABBCABCCCCABACAACBBCACBAACCAABAABBAABACBACCBACAABCACA.exe"	svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3404	sc.exe
5064	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3100	cmd.exe
664	cmd.exe
3856	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_ac9c0c2fec442f9abb8b2afcb31d4d28_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABBCABCCCCABACAACBBCACBAACCAABAABBAABACBACCBACAABCACA.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3420	2026-09-06_ac9c0c2fec442f9abb8b2afcb31d4d28_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
3420	2026-09-06_ac9c0c2fec442f9abb8b2afcb31d4d28_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
3420	2026-09-06_ac9c0c2fec442f9abb8b2afcb31d4d28_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
3420	2026-09-06_ac9c0c2fec442f9abb8b2afcb31d4d28_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
592	svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe
592	svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe
592	svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe
592	svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3420	2026-09-06_ac9c0c2fec442f9abb8b2afcb31d4d28_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Token: SeDebugPrivilege	592	svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1632	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 664	3420	2026-09-06_ac9c0c2fec442f9abb8b2afcb31d4d28_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe	101
PID 664 wrote to memory of 3764	664	cmd.exe	103
PID 592 wrote to memory of 4796	592	svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe	104
PID 4796 wrote to memory of 844	4796	notepad.exe	105
PID 3420 wrote to memory of 3856	3420	2026-09-06_ac9c0c2fec442f9abb8b2afcb31d4d28_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe	107
PID 3856 wrote to memory of 3404	3856	cmd.exe	109
PID 3420 wrote to memory of 3100	3420	2026-09-06_ac9c0c2fec442f9abb8b2afcb31d4d28_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe	110
PID 3100 wrote to memory of 5064	3100	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-09-06_ac9c0c2fec442f9abb8b2afcb31d4d28_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_ac9c0c2fec442f9abb8b2afcb31d4d28_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACAAABCABBBCCABBACBBCAABACBBCCAAABCCCBBACCACCBBBBCBAAACBCCCABABCACCACBBBCBBABBCBCCBCAAACCACCBCACABACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACAAABCABBBCCABBACBBCAABACBBCCAAABCCCBBACCACCBBBBCBAAACBCCCABABCACCACBBBCBBABBCBCCBCAAACCACCBCACABACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBACCACCBBACAAACACABCAACAAABABBBCCABCBCBCCBBBBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe" start= auto displayName= "UserDataSvc_BACBACCACCBBACAAACACABCAACAAABABBBCCABCBCBCCBBBBABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBACCACCBBACAAACACABCAACAAABABBBCCABCBCBCCBBBBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe" start= auto displayName= "UserDataSvc_BACBACCACCBBACAAACACABCAACAAABABBBCCABCBCBCCBBBBABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBACCACCBBACAAACACABCAACAAABABBBCCABCBCBCCBBBBABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBACCACCBBACAAACACABCAACAAABABBBCCABCBCBCCBBBBABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5064

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:592
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:844

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe
1⤵
- Executes dropped EXE
PID:1224

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCABCCCCABACAACBBCACBAACCAABAABBAABACBACCBACAABCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCABCCCCABACAACBBCACBAACCAABAABBAABACBACCBACAABCACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 425744e7ed1ad939a0ca47b2ecec02907e1bb850782ffcbd3b55b4d5d12952f3
MD5 13e96e1b364536848bef90d42be06edc
SHA1 af1c51220d785c4a0b095a5b50e7d0b166ea3eb5
SHA512 27f8e23c971b0f6cafcf232c636700d2a05863758d5310be71b8a1b6ae06a9bc4e704a9ee62b45ba6ec6343e9d77c12681ff290de7565a7424c96a84de30abe4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4d2baed175e081643db67a9fc0b14946966675cea4fa42078b6d66bb16b57ab4
MD5 c3a1402f2bb7a36bde01f75d4fb4037f
SHA1 8a0e45c4f7e27a1abdbd444b87667ac6506e33a1
SHA512 bbf82b18d1b288df27bd8e08e2d78c45191fb1b2a70d768f5ca7ca858d1a84613ad521c63d73742ffad6bdb4cdc586c97829cd428e087a3745cfcb88e4c5665b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a874e7c433fdaad79697f1bd3706bf589ad3417c2d1ca73aa2cbd8c624f12adc
MD5 e621d94a6f58c7de142c2e7e5ec0159a
SHA1 8642208adfe37dd1da454134c0d73d351269c34a
SHA512 ab6b68e37c9d2b0abe027553487bfe4d7c0ec763c78021b1c8b1217722f308cdf941a3f1b91c0de73fc9f81d69edbc98efdcdca2f9533f274d8439858a11e38c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0560fae05a9202f359238823bd13b4542b400c0b28b2cf394732127391a0cf34
MD5 c813c1b700686cc864241188add62391
SHA1 e8c54ce1f38e67757fa0e3ecce599021a4923291
SHA512 a49b6458fbce10d316a9b61bbf66e7962b5de8d22bd4ce874d2627c1141d70d761761c1e0ff5a8f9d8649505495cd277cd20e9fd9f406788ae78e20bd42b83bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8141ac67b6109264def9bf0b2806438c739da2318aa80e66ab769ef76135127d
MD5 0e64f37f292d06f77f4b37cc9a1fc063
SHA1 3f0969180cdc9749a1864a4fe6fc84615b7f0fbc
SHA512 dd964e546fcc80f90f36597aa9e97a5914678057edc849d7e6cdf60ca83abc40fba48c8bcac038b46cd77623b9fdaeaf96e7ce3b7a383a93fa706d25007fb739
MD5 SHA1 SHA512

Submit Download

svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBCAABBCCABABACAAACCCACBACCACBBBCCBBAAABCBBACBCCACA.exe
Size 29.8MB
SHA256 dfdb4eeda7b9a35343d6f8a254b6dd51d1e481efb99c811ee18c8e982b996626
MD5 ac9c0c2fec442f9abb8b2afcb31d4d28
SHA1 2662771733f4c6a4e945873fca9838f4881409a2
SHA512 9f0b6d08b3a9f531d482c06f95ebed8de17f5e6d390229d510b781c97d4568d4cfa5dd35cd6454cf9802e3233dd1b60bd3cedb5204c407fa5b0e22f065740d95
SSDEEP 196608:sHh6ImzD+FMHh6ImzD+FS1tIDewjqkjiqMc:z8X8Kwekyc
TLSH
T127676B18FA9780F1E967417048ABC2BFD6317D114B228BDBE684DB2EAE336D15C35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/592-27-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/592-37-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/3420-0-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/3420-7-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/4796-60-0x00000000026E0000-0x00000000026E1000-memory.dmp

Download