00462587bb936d3bf7098891470f780c32d2a351152c5456c7183eccbb6beb59

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_def55e3c91b6d03c69af56ba72e43298_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 9.8MB
Sample260908-ed59cazves
SHA256 00462587bb936d3bf7098891470f780c32d2a351152c5456c7183eccbb6beb59
MD5 def55e3c91b6d03c69af56ba72e43298
SHA1 707fa44aa1db3a026a645d762f83d7b8d42d9154
SHA512 0f5b5780728dbe49aa0d4127ae48d7822fb86edf3a5315ab7ea8af0f9cce13e8a37be4d8047daf91106e8219c34a14f430c0d91ee58f0c91a2febb0444e8e112
SSDEEP 196608:j5G5L5G5L5G5L5G5L5G5L5G5L5G5L5G5L5G5hHh6ImzD+FM:j5G5L5G5L5G5L5G5L5G5L5G5L5G5L5G3
TLSH
T10BA64B68FBC755B1DA1395B0888BD2FF7E30651043248BEFEA04FB55AE176D1A83E205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5416	svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe
2056	svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe
2684	svchost_ACCBBCCCBBCAACCACCAABCAACBACABCCAACCBBABBBAAAABCACCBABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAAACBAABBBBABBCAABCBCBCABBCCCBAAAACABCCCCBBACABABBACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe"	2026-09-07_def55e3c91b6d03c69af56ba72e43298_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBABACABBCBAAAACAAAAABBCCBCABCBBCABCCABBBCBCABBBBCCBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBBCCCBBCAACCACCAABCAACBACABCCAACCBBABBBAAAABCACCBABA.exe"	svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2732	sc.exe
6092	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2724	cmd.exe
2268	cmd.exe
3232	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_def55e3c91b6d03c69af56ba72e43298_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBBCCCBBCAACCACCAABCAACBACABCCAACCBBABBBAAAABCACCBABA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4296	2026-09-07_def55e3c91b6d03c69af56ba72e43298_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4296	2026-09-07_def55e3c91b6d03c69af56ba72e43298_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4296	2026-09-07_def55e3c91b6d03c69af56ba72e43298_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
4296	2026-09-07_def55e3c91b6d03c69af56ba72e43298_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5416	svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe
5416	svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe
5416	svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe
5416	svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4296	2026-09-07_def55e3c91b6d03c69af56ba72e43298_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	5416	svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 2724	4296	2026-09-07_def55e3c91b6d03c69af56ba72e43298_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	91
PID 2724 wrote to memory of 4628	2724	cmd.exe	93
PID 5416 wrote to memory of 2708	5416	svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe	94
PID 4296 wrote to memory of 2268	4296	2026-09-07_def55e3c91b6d03c69af56ba72e43298_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	95
PID 2268 wrote to memory of 2732	2268	cmd.exe	97
PID 4296 wrote to memory of 3232	4296	2026-09-07_def55e3c91b6d03c69af56ba72e43298_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	98
PID 3232 wrote to memory of 6092	3232	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-09-07_def55e3c91b6d03c69af56ba72e43298_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_def55e3c91b6d03c69af56ba72e43298_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBACCBCAABBACCCBAAAAAAAABCBCACBAABABCCCAACCCACBCCBABABBACABBBBCBCAABBCBCACCCBACBAACCBACCAABACAACAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBACCBCAABBACCCBAAAAAAAABCBCACBAABABCCCAACCCACBCCBABABBACABBBBCBCAABBCBCACCCBACBAACCBACCAABACAACAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABCCCABABBBCBBABAACAACCACBCBBAABABCCBAACACABBAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe" start= auto displayName= "UserDataSvc_ACABCCCABABBBCBBABAACAACCACBCBBAABABCCBAACACABBAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABCCCABABBBCBBABAACAACCACBCBBAABABCCBAACACABBAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe" start= auto displayName= "UserDataSvc_ACABCCCABABBBCBBABAACAACCACBCBBAABABCCBAACACABBAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABCCCABABBBCBBABAACAACCACBCBBAABABCCBAACACABBAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABCCCABABBBCBBABAACAACCACBCBBAABABCCBAACACABBAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe
1⤵
- Executes dropped EXE
PID:2056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCCCBBCAACCACCAABCAACBACABCCAACCBBABBBAAAABCACCBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCCCBBCAACCACCAABCAACBACABCCAACCBBABBBAAAABCACCBABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d0422d97f86ea1fe218cbb6ee4c87250e79c70f4c9d7337758b0031d663dcb21
MD5 fcec8268cf31fb23af309b2567664bdf
SHA1 6d47f5667e359160f733b35e5a2d30dbfbad1318
SHA512 30d93f02471af12cf43cc0fa6e9d7a55a3a07af983ae7fcdc127c5ab7ecbf2af6ae706f20462ef900759cc6d739bbb5912e1942312e15dbf15127250a7cf8588
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7ae98717310ca087daa143ae82d312c7ddafdc6bab1d444f82dd584fa2b2b5ee
MD5 d99513f810f095badb110c3d31a24df6
SHA1 c89b4408a84cb20a37d00a28aedd763ef4111dac
SHA512 16234bd27d0580af4e92d746b1d0dc06598ba804d7b45cab75357d484132c6c874ed4c2ad76788f20c9d7e6375a68dc30502ed875d769c179d2d1b0c2759a678
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cfbe6720150213a1bc1ba86d80aee0efcfb4767531d702ce3be0dddc1a0991bc
MD5 b2e64cc148c1712371809bb58416ee18
SHA1 8adfd8ace825726ecc61b8e948ebb650a2a53228
SHA512 46979193fe1c21138a048d476b2b262839bb162e07086b757833ca3440f0ee81689123d9e7ebb4a309a1578a8e596310d3f24021b7e85fd7cacffcff69e7f3c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8be63e88eb946b6141e2eacfed31628659cac3717978d126feb264929b973b08
MD5 521cc50dc1baa4036e3ad0184cb4a578
SHA1 69c7c276157fd4d8ae353d4fca6d193aaab8a682
SHA512 9904c7e0c1b23bb0d5be30c62ffcd4ff2b1ff6ee0b156c62eb0569e3bad9cf942eedfce78bda74f3fcf80af51416c7aa7ce2ea052c7354cac12627f027e233ce
MD5 SHA1 SHA512

Submit Download

svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBAAABCAAACCAAAAACCBBCCBCCBCACABACAAABABBBCAABBACA.exe
Size 9.8MB
SHA256 00462587bb936d3bf7098891470f780c32d2a351152c5456c7183eccbb6beb59
MD5 def55e3c91b6d03c69af56ba72e43298
SHA1 707fa44aa1db3a026a645d762f83d7b8d42d9154
SHA512 0f5b5780728dbe49aa0d4127ae48d7822fb86edf3a5315ab7ea8af0f9cce13e8a37be4d8047daf91106e8219c34a14f430c0d91ee58f0c91a2febb0444e8e112
SSDEEP 196608:j5G5L5G5L5G5L5G5L5G5L5G5L5G5L5G5L5G5hHh6ImzD+FM:j5G5L5G5L5G5L5G5L5G5L5G5L5G5L5G3
TLSH
T10BA64B68FBC755B1DA1395B0888BD2FF7E30651043248BEFEA04FB55AE176D1A83E205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4296-0-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/4296-7-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/5416-24-0x0000000000820000-0x0000000000841000-memory.dmp

Download

memory/5416-37-0x0000000000820000-0x0000000000841000-memory.dmp

Download