593f78b18b228b66a5d2cf8718f3fcb941eadc879afc3863253520375e022dc2

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_da2c39dda5d14473e2f24bcb989cd37f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 9.9MB
Sample260910-2r2jmsxbma
SHA256 593f78b18b228b66a5d2cf8718f3fcb941eadc879afc3863253520375e022dc2
MD5 da2c39dda5d14473e2f24bcb989cd37f
SHA1 ba7834860ea9237136ce8a53d7579315261004fc
SHA512 87a628cb0e67550b13c69100ab00e24c14ecbdb71802fa3edbd11e07dcdcc2d71bd6c7b641f37de9d49e26005587a7bfa0b4b8ebbde4300112cfca7860977587
SSDEEP 98304:l5QI5QI5QI5QI5QI5QI5QI5QC/fh6ImzzJoDfuBcMv+A73XAO:l5j5j5j5j5j5j5j5rHh6ImzD+FO
TLSH
T16AB66B55FB8751F2D91341704897C2BB6F30B9104B358BDBE744AB2EAE237D0AA36316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
7124	svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe
4428	svchost_BACBCABABAACBACCBCACAACCBBCCACBABBBCCCABCABCABABCACACAC.exe
5676	svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCCCBBCABBABBAAABBABBCACCCACBBABCBCBABCAACBABCABCAAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe"	2026-09-09_da2c39dda5d14473e2f24bcb989cd37f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBABCABCCBBAABAABBBBCBCBACAAACACBCCBCABCAABCACBAACAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBCABABAACBACCBCACAACCBBCCACBABBBCCCABCABCABABCACACAC.exe"	svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6704	sc.exe
5128	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6604	cmd.exe
4852	cmd.exe
3068	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_da2c39dda5d14473e2f24bcb989cd37f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBCABABAACBACCBCACAACCBBCCACBABBBCCCABCABCABABCACACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1976	2026-09-09_da2c39dda5d14473e2f24bcb989cd37f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1976	2026-09-09_da2c39dda5d14473e2f24bcb989cd37f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1976	2026-09-09_da2c39dda5d14473e2f24bcb989cd37f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1976	2026-09-09_da2c39dda5d14473e2f24bcb989cd37f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
7124	svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe
7124	svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe
7124	svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe
7124	svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe
4428	svchost_BACBCABABAACBACCBCACAACCBBCCACBABBBCCCABCABCABABCACACAC.exe
4428	svchost_BACBCABABAACBACCBCACAACCBBCCACBABBBCCCABCABCABABCACACAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	2026-09-09_da2c39dda5d14473e2f24bcb989cd37f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	7124	svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe
Token: SeDebugPrivilege	4428	svchost_BACBCABABAACBACCBCACAACCBBCCACBABBBCCCABCABCABABCACACAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 6604	1976	2026-09-09_da2c39dda5d14473e2f24bcb989cd37f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	92
PID 6604 wrote to memory of 4584	6604	cmd.exe	94
PID 7124 wrote to memory of 3456	7124	svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe	95
PID 1976 wrote to memory of 4852	1976	2026-09-09_da2c39dda5d14473e2f24bcb989cd37f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	98
PID 4852 wrote to memory of 5128	4852	cmd.exe	100
PID 1976 wrote to memory of 3068	1976	2026-09-09_da2c39dda5d14473e2f24bcb989cd37f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	101
PID 3068 wrote to memory of 6704	3068	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-09_da2c39dda5d14473e2f24bcb989cd37f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_da2c39dda5d14473e2f24bcb989cd37f_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACCBACBCABCBAACABBACACCCCBACBCCBBABCCBCBABBCCAAABBAACBBCCCCCCBBBBBBCBCBCBAABCACCBCCABABBBACBBCCCBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACCBACBCABCBAACABBACACCCCBACBCCBBABCCBCBABBCCAAABBAACBBCCCCCCBBBBBBCBCBCBAABCACCBCCABABBBACBBCCCBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABBABCABBABAACBBCAACCBBBBBAACCBACBBCCCABABBBABACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe" start= auto displayName= "UserDataSvc_CCABBABCABBABAACBBCAACCBBBBBAACCBACBBCCCABABBBABACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABBABCABBABAACBBCAACCBBBBBAACCBACBBCCCABABBBABACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe" start= auto displayName= "UserDataSvc_CCABBABCABBABAACBBCAACCBBBBBAACCBACBBCCCABABBBABACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABBABCABBABAACBBCAACCBBBBBAACCBACBBCCCABABBBABACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABBABCABBABAACBBCAACCBBBBBAACCBACBBCCCABABBBABACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:7124
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCABABAACBACCBCACAACCBBCCACBABBBCCCABCABCABABCACACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCABABAACBACCBCACAACCBBCCACBABBBCCCABCABCABABCACACAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe
1⤵
- Executes dropped EXE
PID:5676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 84fa970761d1698c7d9092e328eb9e8fcfd2b6ea2a7a53e957cce8c09ce635f5
MD5 d33295e6339519504b1d1a11159118d5
SHA1 87020e2356df4b285118f2aa1c7f874658c388bb
SHA512 d56963c6375ca4fbb36090e7fede878b114c63f6fca6add28e459d37553798b1e7df856731c2e3a54072518c42a2a93a2e59799b81b6a4eadbd1be8b8f70d6e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c06c603cbf68e5c7a79d4933448bfe3efc9fdafc45522cf5cf238f7566e3b54a
MD5 48d48ee06332f93e1c54df8119b542fd
SHA1 387bce37dfefe3a0f1637860d32378960bd06a01
SHA512 fa1d0ef007c656ade8ad479d011328d22bce75b6384c84f31a524e442c5d172b2c0e1d4e154671582bbf14cdfbe92669372a97029596794567a5f35de33075f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e4269c3f933089881c8a79c40f48b5fd3f125dea3de3b5e90e05014200bd9992
MD5 9aa191a1572ae1c4d647c946d9a6410b
SHA1 4013802044fdcef10c9449ab2e2fe04b65814401
SHA512 16d0cad7471920d4f20196f06c5ae41c467487b9ab3733f250b311e1039d4f9775803473ca5d07f29ada166b5f7944e752297052ae9c3a2e6bf330ad6ec66e1b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a93a2ef0b9c745fbd7a597392781e8148d59b997b7639fc11639d47e3b092a97
MD5 a29bd163b6a5b9e46a1383c7ed0f9cf3
SHA1 213a98d87cfc3e320d23db7bad58dd9e1906cb8e
SHA512 886e0e21b97b376425b5d1ac90ea959883d9941ed271ad3a71ca4b5619a773c090568bc61ffb22a588fb243895c7638dfbb9df1f685e6dfa4a3a2011c9604583
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8ebbe4bd25199228cff131986582a49daed67883f6939c822fc4e976e4e08bbf
MD5 fc388310cabc7e6e616a192506e33c4e
SHA1 5c0a26568e7006440bf4472bd5efa7198038c726
SHA512 80f87a13415743c55d17ff68e3edeb18caa3befa4576a648c113c71f4634655cdeaa35ca56ece867d100f05f2c66a1b13916bb63e2dc9c393641a10e838508f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a2eb277683a9c97bab40fe3ab5e165f8695c5f0e04955de181d9e7b019faffdf
MD5 3b43cfcc836a9b62f53560e0ad438b01
SHA1 61659202eff23176306fcabb04f5501c73603def
SHA512 23d63178037a16c6dba9f166ce4adf31b75c0ae14dc390bd88ee28458b056abb41d5f216b8a717c259137a63721da70cd6df7eeb80dd226099da5c3c1f6f2ab0
MD5 SHA1 SHA512

Submit Download

svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABBAAAABAACCBACCCAAABCABACCABACBBABBCCCCACAAACBA.exe
Size 9.9MB
SHA256 593f78b18b228b66a5d2cf8718f3fcb941eadc879afc3863253520375e022dc2
MD5 da2c39dda5d14473e2f24bcb989cd37f
SHA1 ba7834860ea9237136ce8a53d7579315261004fc
SHA512 87a628cb0e67550b13c69100ab00e24c14ecbdb71802fa3edbd11e07dcdcc2d71bd6c7b641f37de9d49e26005587a7bfa0b4b8ebbde4300112cfca7860977587
SSDEEP 98304:l5QI5QI5QI5QI5QI5QI5QI5QC/fh6ImzzJoDfuBcMv+A73XAO:l5j5j5j5j5j5j5j5rHh6ImzD+FO
TLSH
T16AB66B55FB8751F2D91341704897C2BB6F30B9104B358BDBE744AB2EAE237D0AA36316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d16e8f60c27a98918a10db7417711e70b7ee8724ad524f1ab5bef33ecda47359
MD5 4e4216dfb19f0173916b50f2ce863716
SHA1 ab6c4a7d86fa1f84464094d57e1278f7ff4e2074
SHA512 f0e0700e865a58c7904bc0e0c194ac4aaf39f094dc363d2a629f9985b8fd474b883157774e17bcae590f128351170774f4160edbcf13904045fd627df6309b88
TLSH
T1DA115E50B0B5EC23F62168CA5629DB561CE4378FAC9CAF186309521CE725C39DE2D0F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1976-0-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/1976-7-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/4428-79-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/5676-81-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/7124-33-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/7124-23-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download