eb620a35dbc8e883d9d464102822e0711631b1ffda77fae6b3f794d846ef6160

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 17:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_7182df6deb499b8f6156d5d632d4c4d8_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe
Size 20.4MB
Sample260907-wjky2asdpg
SHA256 eb620a35dbc8e883d9d464102822e0711631b1ffda77fae6b3f794d846ef6160
MD5 7182df6deb499b8f6156d5d632d4c4d8
SHA1 25b64f4de70aaa0bdb4404eb1d0bbb2c6c45eed9
SHA512 66d881a81d80a941722a1484f2b7c9e186f1b5249b74ab953b1f351a2e14de5c1244aafca3a34de1372029231044cf3e9e5d0ced603cb7bbd6f91086be601096
SSDEEP 196608:kmmImmImmImmImmImmImmImmdHh6ImzD+Ft:EQ
TLSH
T186276C05F99344F1D927417049DBE27FC630BA158722CEEBE7588B5BAE23BA16C39311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4692	svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe
3716	svchost_AABACAABBCACBBBCCACBBBBACAABCCAACBBACCCCBCCBACCBCCBBACB.exe
5056	svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CABABABABCCAABCBCCCACBCABBACABACBCCAABBBBBABBACAABCCBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe"	2026-09-05_7182df6deb499b8f6156d5d632d4c4d8_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCACCACCBCCABBBCBABCCABCCABBABCCACBACBBABBCAAACBAABABCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABACAABBCACBBBCCACBBBBACAABCCAACBBACCCCBCCBACCBCCBBACB.exe"	svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5092	sc.exe
3148	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2872	cmd.exe
2956	cmd.exe
4332	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABACAABBCACBBBCCACBBBBACAABCCAACBBACCCCBCCBACCBCCBBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_7182df6deb499b8f6156d5d632d4c4d8_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2860	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3184	2026-09-05_7182df6deb499b8f6156d5d632d4c4d8_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe
3184	2026-09-05_7182df6deb499b8f6156d5d632d4c4d8_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe
3184	2026-09-05_7182df6deb499b8f6156d5d632d4c4d8_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe
3184	2026-09-05_7182df6deb499b8f6156d5d632d4c4d8_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe
4692	svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe
4692	svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe
4692	svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe
4692	svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe
3716	svchost_AABACAABBCACBBBCCACBBBBACAABCCAACBBACCCCBCCBACCBCCBBACB.exe
3716	svchost_AABACAABBCACBBBCCACBBBBACAABCCAACBBACCCCBCCBACCBCCBBACB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3184	2026-09-05_7182df6deb499b8f6156d5d632d4c4d8_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe
Token: SeDebugPrivilege	4692	svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe
Token: SeDebugPrivilege	3716	svchost_AABACAABBCACBBBCCACBBBBACAABCCAACBBACCCCBCCBACCBCCBBACB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3688	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 2872	3184	2026-09-05_7182df6deb499b8f6156d5d632d4c4d8_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe	103
PID 2872 wrote to memory of 2860	2872	cmd.exe	105
PID 4692 wrote to memory of 3300	4692	svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe	106
PID 3300 wrote to memory of 2996	3300	notepad.exe	107
PID 3184 wrote to memory of 2956	3184	2026-09-05_7182df6deb499b8f6156d5d632d4c4d8_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe	111
PID 2956 wrote to memory of 5092	2956	cmd.exe	113
PID 3184 wrote to memory of 4332	3184	2026-09-05_7182df6deb499b8f6156d5d632d4c4d8_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe	114
PID 4332 wrote to memory of 3148	4332	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-09-05_7182df6deb499b8f6156d5d632d4c4d8_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_7182df6deb499b8f6156d5d632d4c4d8_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABCCBAACBBABCACCAABBBACCABAABBBAAABCBABCBBCBCBABCABAACBAAAABBAAAACBAACBCBBAACCBAACBCAABCBBCCBABBCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABCCBAACBBABCACCAABBBACCABAABBBAAABCBABCBBCBCBABCABAACBAAAABBAAAACBAACBCBBAACCBAACBCAABCBBCCBABBCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACAACCACCACABBBCAABCCAACBCCCAAACCCBACBAABBBABABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe" start= auto displayName= "UserDataSvc_ACACAACCACCACABBBCAABCCAACBCCCAAACCCBACBAABBBABABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACACAACCACCACABBBCAABCCAACBCCCAAACCCBACBAABBBABABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe" start= auto displayName= "UserDataSvc_ACACAACCACCACABBBCAABCCAACBCCCAAACCCBACBAABBBABABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACACAACCACCACABBBCAABCCAACBCCCAAACCCBACBAABBBABABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACACAACCACCACABBBCAABCCAACBCCCAAACCCBACBAABBBABABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2996

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3688

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACAABBCACBBBCCACBBBBACAABCCAACBBACCCCBCCBACCBCCBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACAABBCACBBBCCACBBBBACAABCCAACBBACCCCBCCBACCBCCBBACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe
1⤵
- Executes dropped EXE
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8d84c31bb57eb4865a6ce6432f2203507f1601e0d5650ed6c8e174d19c82c08e
MD5 e4cbbdd3d3e295b1e3cfda141b78206c
SHA1 4cf0f004bb31c7108fec7bbafc92824651c42137
SHA512 aa28aaa2b7033d9c7ed69c085ce243c3c67ca4af41aef712ecbe3a9a43c3222f3adcd51b1c86bf31437da747eba34d7d41f6ea3414ecf95fd64439b2b2e014cd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 86ea306405696e94dd23edeaaa8dce7724ac47678f54121532eae2ff057b5f56
MD5 8bedd2e5927f955b692c61c1ea9d286f
SHA1 be2e2686ad6fb064841e1c03f10c4d64de9d0312
SHA512 136856c7b35d326c1b4a10021d4a28fb7cb2614d6a6ba5c23ce4ae105c62c6ee15a35495e918ad5032eb4218c9210e795e3562022b77701d0f1857d1a8f28947
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cea7ffc4d21d1c5e6c4e7f308956d77f1cba78f51c0dfec155a28fd01dd8fec2
MD5 6c84169155b11a0f89ccf89927bd521b
SHA1 0c332f1df43a3b5aab8b68da3baa29fc7c9876e4
SHA512 7c583c97ade0f77ec22a51e790a8941502cebd7147a294ff1ff2fc018ffc175feb2e89e134fd9521a2c61b087eea52dd009b7ecd52079d93d4b383ef1cb2dc78
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b3c01f3929f0a5ed013ba96087571f29d8ee0a7aa6f96729fda1ebeadeed70ce
MD5 87fe3ccb180899750f5518cb35535d5e
SHA1 cbd5bcdd038943004e92a754f1a9d559e4e8a34e
SHA512 f3570b11bf4cc12e6849fc6e43def587b163d4003d0b0279eb98dcbeccc725be8d071a171d40e0f160d398607e0e8e4c4f451a2ba46fc359aeba50b8aee957a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 70fa3dbb9a932aaa3231273aba9afea148b9db92075b35d35504f33157278442
MD5 6653093cf77e24d487248e3495bd22bf
SHA1 38d1ee3e6b307524219347700c90a3478bece50a
SHA512 5502d0eaed80eb69a4a5006645474316d29ddfb22be12091f683cfddbef1b340f8e8af1ee93e796a45a2d58e68b402d6787d3ecfb9e6c92549ab17675479b800
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 73bacbcdad37c210509083dacf109abfe3df0968fffe3eea91c1e70454ebb70a
MD5 c095d120a056c82ef659249f74116f28
SHA1 02530901637646deed3e94337e193633b85ad991
SHA512 df24f5cd2ae645e9bd996c1df760aed989306ce8a193f86fac2112e2953b5f5c0a13878f7dbb6b373389978e438d99818eda95897dfb2c0ada6a6aa196339492
MD5 SHA1 SHA512

Submit Download

svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAACBAAACACCBBBCCAACCCBCBAAAACCABBCAAAABCCACABBACCAB.exe
Size 20.4MB
SHA256 eb620a35dbc8e883d9d464102822e0711631b1ffda77fae6b3f794d846ef6160
MD5 7182df6deb499b8f6156d5d632d4c4d8
SHA1 25b64f4de70aaa0bdb4404eb1d0bbb2c6c45eed9
SHA512 66d881a81d80a941722a1484f2b7c9e186f1b5249b74ab953b1f351a2e14de5c1244aafca3a34de1372029231044cf3e9e5d0ced603cb7bbd6f91086be601096
SSDEEP 196608:kmmImmImmImmImmImmImmImmdHh6ImzD+Ft:EQ
TLSH
T186276C05F99344F1D927417049DBE27FC630BA158722CEEBE7588B5BAE23BA16C39311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 ac2aacc21d4b5669b91fc63f7b459c5bfce23ca1c17346a9c6ce08546cbf5fee
MD5 4232673562f5accce6b6aba1c77aba76
SHA1 c6f0c5981d7eeef4ba10cefaee42f65c8af44721
SHA512 5a275da1bf77cf8f085995a45a45fd4bf8fe5e2e272d223a7e99c810550ebb5b217f11bf31c71b6c0ffa4197213c9b00516a466173807e2aea8045244f2b324c
TLSH
T1BC11AB62F065D897F93268DBBE29CB4708D43BAF7958AB1C1304C2187F16C774D154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3184-8-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/3184-0-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/3300-60-0x0000000005680000-0x0000000005681000-memory.dmp

Download

memory/3716-82-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/4692-37-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download