f2c9b10ffea35a5d2c257b3096dff49ea0b17fd9e99404cfbdb4baa776d15afe

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_d51be8ee68cbfc78ed96c87f173df893_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe
Size 8.3MB
Sample260907-lvb56asscs
SHA256 f2c9b10ffea35a5d2c257b3096dff49ea0b17fd9e99404cfbdb4baa776d15afe
MD5 d51be8ee68cbfc78ed96c87f173df893
SHA1 497e62b382e51c8900047c3102d8b66fbeaae500
SHA512 382415c33207d1ca215bc3d19533d1e8319a380ea144f846ed0411e53132c0966dc28934d704c5ae5f0edfc5d1768380b0fc13dfc53616c69ac4bd0e8453abe7
SSDEEP 49152:U+Eu+Eu+Eu+E6M+Eu+Eu+Eu+Eu+E6M+Eu+Eu+Eu+Eu+E6M+Eu+Eu+Eu+Eu+E6M+t:Qjjjjjjx/fh6ImzzJoDfuBcMv+A73XA
TLSH
T12B967B05F99744F1EA174570489BE27F9730BA058322CFE7E7488B57EA23BE15D3A212
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2900	svchost_AABABBCCCACCCABBABCBCBCCACCABBACCACAAABBCBBCAABBBCAAABB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCABCCABCCACCBABBAACAACBCCAAACCABCBBBBABABABABBCACCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABABBCCCACCCABBABCBCBCCACCABBACCACAAABBCBBCAABBBCAAABB.exe"	2026-09-05_d51be8ee68cbfc78ed96c87f173df893_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5940	cmd.exe
2004	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABABBCCCACCCABBABCBCBCCACCABBACCACAAABBCBBCAABBBCAAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_d51be8ee68cbfc78ed96c87f173df893_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3264	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4124	2026-09-05_d51be8ee68cbfc78ed96c87f173df893_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe
4124	2026-09-05_d51be8ee68cbfc78ed96c87f173df893_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe
4124	2026-09-05_d51be8ee68cbfc78ed96c87f173df893_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe
4124	2026-09-05_d51be8ee68cbfc78ed96c87f173df893_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe
2900	svchost_AABABBCCCACCCABBABCBCBCCACCABBACCACAAABBCBBCAABBBCAAABB.exe
2900	svchost_AABABBCCCACCCABBABCBCBCCACCABBACCACAAABBCBBCAABBBCAAABB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4124	2026-09-05_d51be8ee68cbfc78ed96c87f173df893_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe
Token: SeDebugPrivilege	2900	svchost_AABABBCCCACCCABBABCBCBCCACCABBACCACAAABBCBBCAABBBCAAABB.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 5940	4124	2026-09-05_d51be8ee68cbfc78ed96c87f173df893_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe	91
PID 5940 wrote to memory of 3264	5940	cmd.exe	93
PID 4124 wrote to memory of 2004	4124	2026-09-05_d51be8ee68cbfc78ed96c87f173df893_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-09-05_d51be8ee68cbfc78ed96c87f173df893_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_d51be8ee68cbfc78ed96c87f173df893_cobalt-strike_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACACCBABBACCACBBCBBBCCAAAABABCBCBCCCCBCBBBABCCCBABBBAAAAACBCABCAAACABCABBCCCBBACAAACCABAAACBABBCACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBCCCACCCABBABCBCBCCACCABBACCACAAABBCBBCAABBBCAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACACCBABBACCACBBCBBBCCAAAABABCBCBCCCCBCBBBABCCCBABBBAAAAACBCABCAAACABCABBCCCBBACAAACCABAAACBABBCACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBCCCACCCABBABCBCBCCACCABBACCACAAABBCBBCAABBBCAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACABBABCCCACACBAACCBBCBACBABCBAACBCBACCBBCBBACCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBCCCACCCABBABCBCBCCACCABBACCACAAABBCBBCAABBBCAAABB.exe" start= auto displayName= "UserDataSvc_BACABBABCCCACACBAACCBBCBACBABCBAACBCBACCBBCBBACCCBA"
  2⤵
  - Executes a command shell one-liner
  PID:2004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBCCCACCCABBABCBCBCCACCABBACCACAAABBCBBCAABBBCAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBCCCACCCABBABCBCBCCACCABBACCACAAABBCBBCAABBBCAAABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 03a25a166ba0e74ac2da515188e9d97083f2b67e5a5e0f83c18f58e8585e137d
MD5 4340388e0e760be9c5e58419f2b81f1b
SHA1 093acd74b8f8b431a7118ab2ce0c4f4b67414df3
SHA512 09bfd283b51ed718938fd5783156fbaf7f385f39dacc3fa09af1d91e2533ec6d349852b53b156f2a4ccdb9555f53bb886e5a8034511b1fef5bd34a4b5bbf58dc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a49cb9d685923729093e68576b3459bc8f211701579c9c97cd89a966e93e6f31
MD5 ea2f95c04c941f902948b201bc3066ab
SHA1 0a968773866925bcd312edf1b5bf7cc1673692e4
SHA512 6884303f6ed444da480b11d1c3646c47b1b6c3208087e55aaf846528029ac462ee4459a0bbcce2529597fcf440f67294367f11e21dc1b3f218b1b69559d80f38
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 356d5699c6fc66eaa8fb5de896b9b253ec23b27773e791fa0ff8f9d2cf47034e
MD5 60600516833070259d1592fdb13e325c
SHA1 0167abc62a403e3c1eb9ee8993b5bd61af6d2656
SHA512 6e915e1547429e97e5be991e8ade50a975c0f7f7cc890b1787b5223a9c53082bd25a89d8887b87939fbdb309d53f0e1a3abc4f992584cb2b5bf9b18ee72aa607
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b78174918e1dddc166841b11668adc58372d043deae9afa16e8919596989486c
MD5 3fc084c7afd7d2ade8ce9c811dcae15f
SHA1 80017139a9149a2bcabe22f7db4a0cf843256460
SHA512 8f2700a4df99bbdfc854fb1f59a5dd552115bce8ebb3671f5657c83b345bf31428c4c6b3b88470c1193399781a3a0c1342c346d60de3832030feea82c98b081b
MD5 SHA1 SHA512

Submit Download

svchost_AABABBCCCACCCABBABCBCBCCACCABBACCACAAABBCBBCAABBBCAAABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBCCCACCCABBABCBCBCCACCABBACCACAAABBCBBCAABBBCAAABB.exe
Size 8.3MB
SHA256 f2c9b10ffea35a5d2c257b3096dff49ea0b17fd9e99404cfbdb4baa776d15afe
MD5 d51be8ee68cbfc78ed96c87f173df893
SHA1 497e62b382e51c8900047c3102d8b66fbeaae500
SHA512 382415c33207d1ca215bc3d19533d1e8319a380ea144f846ed0411e53132c0966dc28934d704c5ae5f0edfc5d1768380b0fc13dfc53616c69ac4bd0e8453abe7
SSDEEP 49152:U+Eu+Eu+Eu+E6M+Eu+Eu+Eu+Eu+E6M+Eu+Eu+Eu+Eu+E6M+Eu+Eu+Eu+Eu+E6M+t:Qjjjjjjx/fh6ImzzJoDfuBcMv+A73XA
TLSH
T12B967B05F99744F1EA174570489BE27F9730BA058322CFE7E7488B57EA23BE15D3A212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2900-25-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/2900-38-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/4124-0-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/4124-8-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download