7f6ece21fd9e20934aa1a8c252b87370566b904d862c005f165ba0e2f63dee5f

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_a714f64689d293179a51f3ba2fcca52b_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 13.2MB
Sample260910-d67r7sen8s
SHA256 7f6ece21fd9e20934aa1a8c252b87370566b904d862c005f165ba0e2f63dee5f
MD5 a714f64689d293179a51f3ba2fcca52b
SHA1 ec9f5f34747a6a6e20af680d3bd62e498ec7e87f
SHA512 785af0b48aa53d34fbbcdfd9649c0dec2ed0949f9911e23339290e83b0ac58d6483ecdfb881c8dc55207a877f51351203d421c6257b32eca08522b714a290fc2
SSDEEP 49152:U+ES+ES+ES+E7+ES+ES+ES+EQUUP+ES+ES+ES+E7+ES+ES+ES+EQUUP+ES+ES+E+:o/fh6ImzzJoDfuBcMv+A73XAK
TLSH
T1CFE67C05F98750F1E927417048DBD2BF8630BE2587218EEBE788CB6BAD23BD15835716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
712	svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe
6128	svchost_ACBACACBAACAACCCBCCBBABCCBACCCCBBBACCACBCACBBCBCCABABBA.exe
5476	svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACCCBCABBABACCCCAAABCBBCBBCAAACCAAACCBBCCCABBCBCCCABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe"	2026-09-08_a714f64689d293179a51f3ba2fcca52b_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBBCACCBBAAAABBBBACCCBCCCBBACBAACAABCBAAABCCABACCCACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACACBAACAACCCBCCBBABCCBACCCCBBBACCACBCACBBCBCCABABBA.exe"	svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3608	sc.exe
2832	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3360	cmd.exe
4228	cmd.exe
1216	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBACACBAACAACCCBCCBBABCCBACCCCBBBACCACBCACBBCBCCABABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_a714f64689d293179a51f3ba2fcca52b_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1648	2026-09-08_a714f64689d293179a51f3ba2fcca52b_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1648	2026-09-08_a714f64689d293179a51f3ba2fcca52b_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1648	2026-09-08_a714f64689d293179a51f3ba2fcca52b_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
1648	2026-09-08_a714f64689d293179a51f3ba2fcca52b_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
712	svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe
712	svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe
712	svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe
712	svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe
6128	svchost_ACBACACBAACAACCCBCCBBABCCBACCCCBBBACCACBCACBBCBCCABABBA.exe
6128	svchost_ACBACACBAACAACCCBCCBBABCCBACCCCBBBACCACBCACBBCBCCABABBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	2026-09-08_a714f64689d293179a51f3ba2fcca52b_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	712	svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe
Token: SeDebugPrivilege	6128	svchost_ACBACACBAACAACCCBCCBBABCCBACCCCBBBACCACBCACBBCBCCABABBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 3360	1648	2026-09-08_a714f64689d293179a51f3ba2fcca52b_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	91
PID 3360 wrote to memory of 5580	3360	cmd.exe	93
PID 712 wrote to memory of 4536	712	svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe	94
PID 1648 wrote to memory of 4228	1648	2026-09-08_a714f64689d293179a51f3ba2fcca52b_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	97
PID 4228 wrote to memory of 3608	4228	cmd.exe	99
PID 1648 wrote to memory of 1216	1648	2026-09-08_a714f64689d293179a51f3ba2fcca52b_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	100
PID 1216 wrote to memory of 2832	1216	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-08_a714f64689d293179a51f3ba2fcca52b_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_a714f64689d293179a51f3ba2fcca52b_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCAABCACACBABCCBBACBBCCCABBAAAACCACACCCABBCCCABAACCBCBCACCBAABCACCCACBBBCBCBBCBCBCCBCACBBBBBCBCABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCAABCACACBABCCBBACBBCCCABBAAAACCACACCCABBCCCABAACCBCBCACCBAABCACCCACBBBCBCBBCBCBCCBCACBBBBBCBCABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACCAACCCBACBACAABCABBAAACABABBCABBCAABBABBCBBBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe" start= auto displayName= "UserDataSvc_CCACCAACCCBACBACAABCABBAAACABABBCABBCAABBABBCBBBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACCAACCCBACBACAABCABBAAACABABBCABBCAABBABBCBBBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe" start= auto displayName= "UserDataSvc_CCACCAACCCBACBACAABCABBAAACABABBCABBCAABBABBCBBBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACCAACCCBACBACAABCABBAAACABABBCABBCAABBABBCBBBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACCAACCCBACBACAABCABBAAACABABBCABBCAABBABBCBBBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:712
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4536

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACBAACAACCCBCCBBABCCBACCCCBBBACCACBCACBBCBCCABABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACBAACAACCCBCCBBABCCBACCCCBBBACCACBCACBBCBCCABABBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6128

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe
1⤵
- Executes dropped EXE
PID:5476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1193d2f1a6fb74c78e9d3e8b0219b26e5fb263dd6ebf41e02a2d6a1e634b3330
MD5 b4848ec86d15325aa8d5c706b6db402b
SHA1 7fa9b9af2fbc4fb0c0b6ee4d091ed1378838ccbd
SHA512 7e9d7f06505625d7407ff00c6e0e5434e28d44c1e4342747c9eac631cda93228c81538264d428aca78c6f8d282ef7d28862b711ce044e0780ba7cad41bc87632
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b6c8d5a44bfdf4a1b90b85d5c77d9a7472f178763ebb4f78c48bfe8bfff0f776
MD5 3929426a4a2d8c06f5f04d09459f0b1f
SHA1 f70d16832837ae0282e07167b7e2e6f600c4f29c
SHA512 c6315c9e2e4ed9a8efeee0eeb87d771f2028c0ec62ffefd2306625b18f2bb9480429a3bae3d07dc659d289fe96fcf3ad783479a0a1f76d885653bbae0a5b12c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4be041abbe64cc7cc444bd6009c1b21fa2ea444cc1d918d4bc6f9b946f4377e9
MD5 bb4ccf88157586b3e01c6749cca09e93
SHA1 1e2a661e75051f78df857cf1c8dc7386658e0c16
SHA512 0eee66d96ab5420084244a039d777c6646c676e2b97bf36615178974ef99007159666be8de658a29d9c4013aaa4d3d7c2740baae74c58305f7b0b083d4ed56ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6ed656286610024dede84dc97dedfe0c229283ea7645ae6551256e50b9463921
MD5 b46b2000a4b6d5d57c9f1edf49be130c
SHA1 492f921447e534659d15e91f1f36f72314386ef2
SHA512 d4d87d0f5096435dd7e832b19d2547fdbd49f6e4b33de5fd58a3eb8bbde277cfa3185d58faa5fa6b310c37a7c6ac398c9fb065b70baddb4a8345812f5e600b66
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8b72c5ed0c7974785b9f82f9fc6fa533d7a5b68fcea4146251417a8ed91f78b8
MD5 aeb4ffbe20823e2e91e381ce3c8c1ae4
SHA1 34cdffd4eae1d4a5264c94e56f9e05b616297012
SHA512 ed1ed4d272b79855a45117c6a67df71646836431144c29943a6872aca256ec71463241eba3301359bc87f40b456da0c30170c88350665ee29f486a615d432ddd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a20753c5c3df4e1eb4728da52dafd3499271cdaba54446c37ed30f1248c648f7
MD5 5003c701b83dd6b36ab26c3f80191012
SHA1 9dbbc413df7e01b0f7e6552a6f89151932295889
SHA512 387c891332e0daf1ea3a01cc1f73c61731cfdd77783d66ffdccf09c081058c0d0cd0ab0c9420dfb7d06533f6a2331f2fdee830c0f72c422ac70d9313eecf95df
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 82032c0f634c489f4590fbf536d8331a7123c93eb9c716e2f6e84afb18fd4b0e
MD5 880a33ff7b341d3143fd0d13063e1fbe
SHA1 3c2bd58b4110634adae8a8bdc4b852101a465187
SHA512 82d001d492de440f3b1ebf0b75031be068b179fa40a8c55ac8f47613ac15230aae93442f64a76c156a49d06237175457f7627e25e6f84e33382f8cbf9bb45af7
MD5 SHA1 SHA512

Submit Download

svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBAAABACBBCCCCABCBCCBAABBAACBBCCCAAABBBBBABBBBBACCC.exe
Size 13.2MB
SHA256 7f6ece21fd9e20934aa1a8c252b87370566b904d862c005f165ba0e2f63dee5f
MD5 a714f64689d293179a51f3ba2fcca52b
SHA1 ec9f5f34747a6a6e20af680d3bd62e498ec7e87f
SHA512 785af0b48aa53d34fbbcdfd9649c0dec2ed0949f9911e23339290e83b0ac58d6483ecdfb881c8dc55207a877f51351203d421c6257b32eca08522b714a290fc2
SSDEEP 49152:U+ES+ES+ES+E7+ES+ES+ES+EQUUP+ES+ES+ES+E7+ES+ES+ES+EQUUP+ES+ES+E+:o/fh6ImzzJoDfuBcMv+A73XAK
TLSH
T1CFE67C05F98750F1E927417048DBD2BF8630BE2587218EEBE788CB6BAD23BD15835716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 40272955ba8765ff1b3b78d71c7918a0827e6d899b8e1483b95896c8e4b8dded
MD5 59eac688cfdf5452281a36c6c2a13e97
SHA1 ae040fb36532752e92bad68cb4aa8d7e29153826
SHA512 48102e0faf123f3c9068c96a82550ecc890c0d92156f8cf88aa434ce88366bb51ffbf0b61261cac3fe73892d583290d3c7fdb3ecfa6e25d1899b15c5f80a8d03
TLSH
T1DC11E391F0E5D823F03164DB5636DF4B08A97B5B6898EB3422094619EF19C3BCD114E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/712-34-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/1648-0-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/1648-8-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/6128-64-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/6128-82-0x0000000000580000-0x00000000005A1000-memory.dmp

Download