7c1f321c4a4e8363f4b346811b7afcc1c4252806545ddb12b72fa00b7998d8cc

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_c9914c3e11406d4f1e20361b9618569a_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 6.9MB
Sample260908-gnbtlasflc
SHA256 7c1f321c4a4e8363f4b346811b7afcc1c4252806545ddb12b72fa00b7998d8cc
MD5 c9914c3e11406d4f1e20361b9618569a
SHA1 c349e03e1e528eda63c3de8000cfd95338d3fbb1
SHA512 c1691e8ebfe98cf387ed2704d633811baa729954f45965e7ac851afdc641fdac291060a4e93a7ae88e8760222f207023b65dfa7e4e6ad7f7b2414e4b12119207
SSDEEP 49152:U+E7+ES+ES+EA+E7+ES+ES+EA+E7+ES+ES+EA+E7+ES+ES+EA+E7+ES+ES+EA+Eq:q/fh6ImzzJoDfuBcMv+A73XAZ
TLSH
T1B5765B05F98744F1EA0755B048DBE3BF5730AA058326CEE7EB488F57E923BE11936216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2188	svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe
5948	svchost_CACACACABABBBBAACABAABBABCCBBCCACCACCBBABBACABBCBACBBAA.exe
4720	svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAABBCBBCBBCACAABCCCBABACABABAACABACCCCBCBABACBACBBCBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe"	2026-09-07_c9914c3e11406d4f1e20361b9618569a_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBABBABCBBCCBCBCCABBCBBACAABABCBCCCCCAAAABAABBCBCBACCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACACACABABBBBAACABAABBABCCBBCCACCACCBBABBACABBCBACBBAA.exe"	svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5736	sc.exe
4880	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5904	cmd.exe
5836	cmd.exe
5616	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACACACABABBBBAACABAABBABCCBBCCACCACCBBABBACABBCBACBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_c9914c3e11406d4f1e20361b9618569a_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2616	2026-09-07_c9914c3e11406d4f1e20361b9618569a_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
2616	2026-09-07_c9914c3e11406d4f1e20361b9618569a_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
2616	2026-09-07_c9914c3e11406d4f1e20361b9618569a_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
2616	2026-09-07_c9914c3e11406d4f1e20361b9618569a_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
2188	svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe
2188	svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe
2188	svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe
2188	svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe
5948	svchost_CACACACABABBBBAACABAABBABCCBBCCACCACCBBABBACABBCBACBBAA.exe
5948	svchost_CACACACABABBBBAACABAABBABCCBBCCACCACCBBABBACABBCBACBBAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	2026-09-07_c9914c3e11406d4f1e20361b9618569a_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	2188	svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe
Token: SeDebugPrivilege	5948	svchost_CACACACABABBBBAACABAABBABCCBBCCACCACCBBABBACABBCBACBBAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 5836	2616	2026-09-07_c9914c3e11406d4f1e20361b9618569a_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	91
PID 5836 wrote to memory of 1392	5836	cmd.exe	93
PID 2188 wrote to memory of 1252	2188	svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe	94
PID 2616 wrote to memory of 5616	2616	2026-09-07_c9914c3e11406d4f1e20361b9618569a_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	97
PID 5616 wrote to memory of 5736	5616	cmd.exe	99
PID 2616 wrote to memory of 5904	2616	2026-09-07_c9914c3e11406d4f1e20361b9618569a_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	100
PID 5904 wrote to memory of 4880	5904	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-07_c9914c3e11406d4f1e20361b9618569a_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_c9914c3e11406d4f1e20361b9618569a_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBBCABBACCBAABACBACBAABACCACCCCCABABACCAACBABBCABACAABBACACBACABAACAAAAAABCCCCBCAAACBBCBCAAABCABACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBBCABBACCBAABACBACBAABACCACCCCCABABACCAACBABBCABACAABBACACBACABAACAAAAAABCCCCBCAAACBBCBCAAABCABACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBCAABCBAABCCCCCBABAACBCABBCBBCBCABAACAACCBBCBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe" start= auto displayName= "UserDataSvc_CACBCAABCBAABCCCCCBABAACBCABBCBBCBCABAACAACCBBCBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBCAABCBAABCCCCCBABAACBCABBCBBCBCABAACAACCBBCBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe" start= auto displayName= "UserDataSvc_CACBCAABCBAABCCCCCBABAACBCABBCBBCBCABAACAACCBBCBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBCAABCBAABCCCCCBABAACBCABBCBBCBCABAACAACCBBCBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBCAABCBAABCCCCCBABAACBCABBCBBCBCABAACAACCBBCBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1252

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACACABABBBBAACABAABBABCCBBCCACCACCBBABBACABBCBACBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACACABABBBBAACABAABBABCCBBCCACCACCBBABBACABBCBACBBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe
1⤵
- Executes dropped EXE
PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5c4d0431960893a77b8b87dd4ee77c021b279688718c3beec2845b166516ede0
MD5 688db0738b9d2b07cfdd680c6aab07e2
SHA1 b5468c6774bf8e1cd6d8e0d4979a53129751eb95
SHA512 71ef784ec33de47661dc09ad30106fa1d302a308cabc99c49d6bd860debdd7ed8c5fc22ebf78d301ffc0573bbb5caec1c2bdabebc07b67b9bf0de1cbb5299bee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1c7f1215a3f13d7e22b8ec622a291e9ebb73a1647e8cba08b3b789f70e193181
MD5 ab47735773e83189bbcf62bb96b1049c
SHA1 77d0c491266df1bdd22560bd6aaec28fd5d41e64
SHA512 86d29e1a11f8275d456b19be2481c4c5ab36a441f947d72ab033f0fd3caa79d8758eda6daab7b02f832238b37e14e68c921df52e6c026cce10390a7790a041e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 56c60086c315acf68bbecfea7e5cd5799fd4f8d1316ad62694dce7085a742c7c
MD5 76fe4dd80b5c0f67ff27794fe5854414
SHA1 be769488815aca67867738afec0920cdd5d935f2
SHA512 881033e0070e4a58488046351de70c3c698759134e743765a92d16b81ad1c6bf3ede309be11d663d36df87266992453c04741e95d9337ec7b280ef6a283c87a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 72cf6b1f6bf92556515b04bb7459ce896b87e6582908885166c3771bc8ba43fa
MD5 8c2cce867acaa0c8681e1ab92dc1ec14
SHA1 a64b7d2fe0b625f5cba71585d469062eeed7e2ac
SHA512 ab9d93325bc2838c91aa2ec2a714ba632fdab510ef3d2a5828459e054cfc9cc6424f3663275ba8fc0357ee690b3e848b4fa851f135c9072b28f4995dfc56b0fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7da1188d408fe5a177a8040275df860a3d4e60157ca9c9a5dc37b6d36eb75526
MD5 a28cda4f23ae40e962ba706425c21783
SHA1 c7d98e98162e85d39cebd19d0f366e170c4f4422
SHA512 7d53a3d3f01554bb27341442a5f65558bc533b49998a162d1807810295140b946c9902cd35182624c5532dd6f4030a072d5081216e646632049541536f8174e4
MD5 SHA1 SHA512

Submit Download

svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCABBBBBCAABBAACCABBACCACABBCBCACCCCACABCAABAAABCBAC.exe
Size 6.9MB
SHA256 7c1f321c4a4e8363f4b346811b7afcc1c4252806545ddb12b72fa00b7998d8cc
MD5 c9914c3e11406d4f1e20361b9618569a
SHA1 c349e03e1e528eda63c3de8000cfd95338d3fbb1
SHA512 c1691e8ebfe98cf387ed2704d633811baa729954f45965e7ac851afdc641fdac291060a4e93a7ae88e8760222f207023b65dfa7e4e6ad7f7b2414e4b12119207
SSDEEP 49152:U+E7+ES+ES+EA+E7+ES+ES+EA+E7+ES+ES+EA+E7+ES+ES+EA+E7+ES+ES+EA+Eq:q/fh6ImzzJoDfuBcMv+A73XAZ
TLSH
T1B5765B05F98744F1EA0755B048DBE3BF5730AA058326CEE7EB488F57E923BE11936216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 aac7d53221e97dc24c1697ecf4ab395b384b765c67738aa4c34d4a845aa279d7
MD5 6a1c5b48e01b1d6daf801f8de4e582db
SHA1 57b5e9d0dc2e4377d3dd72071e82bef08d7a7d3b
SHA512 257e9ef21fb596607fae3f936a836c892926f844cf5f8626d730f5d060836cf55e7b7cbd3e05925654c012c5055a58abc7c4e8d4d325a0619cb785d39581a633
TLSH
T11F11EB41F067DC97E071249B5B368BC74CA43B5B5C9CBB549349831AB749C39CE1E4E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2188-24-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/2188-34-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/2616-0-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/2616-8-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/5948-79-0x0000000000A10000-0x0000000000A31000-memory.dmp

Download