5e6af9a0f9625b406834de49bf3fe817b92208a4d6f6d90280358ce5068d784e

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_b8b52c1fe2cb30ec8d3ad982f9d63ac8_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Size 13.0MB
Sample260910-dphfzsvgjf
SHA256 5e6af9a0f9625b406834de49bf3fe817b92208a4d6f6d90280358ce5068d784e
MD5 b8b52c1fe2cb30ec8d3ad982f9d63ac8
SHA1 181d067ad9d7c5ad3925c8c9325b3b2e4f036e5c
SHA512 a780500fa42633279a2d6e38c34df2a1abd3e84e487de5b605661ee1110cd7e1941843a87b5bb038c6e7db0cca4115e3a10a2633b7b1fcc9ba2e1dac16776a8c
SSDEEP 49152:U+E7+EI+ES+ES+E7+EI+ES+ES+E7+EWX+E7+EI+ES+ES+E7+EI+ES+ES+E7+EWXf:O/fh6ImzzJoDfuBcMv+A73XAf
TLSH
T135D65B05F98740B1D91B51B04CCBE3BF8630BB1587228EE7EB4D8B5BB923BE15835256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1580	svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe
2536	svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe
4228	svchost_BCAABCABBBAABABBABCCCCAABCACAACAAAACCABABBBACAACCBAABCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBAABBCBBCABAAABCCBAABBCACBCACACCCACAAABCCBBBBABCCCAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe"	2026-09-08_b8b52c1fe2cb30ec8d3ad982f9d63ac8_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACACBBCCBCACCCBACBCCCBCBBCABCCBBAABCAABACCBBCAAACAACBCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAABCABBBAABABBABCCCCAABCACAACAAAACCABABBBACAACCBAABCC.exe"	svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4088	sc.exe
1252	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3488	cmd.exe
5392	cmd.exe
1124	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAABCABBBAABABBABCCCCAABCACAACAAAACCABABBBACAACCBAABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_b8b52c1fe2cb30ec8d3ad982f9d63ac8_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1100	2026-09-08_b8b52c1fe2cb30ec8d3ad982f9d63ac8_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
1100	2026-09-08_b8b52c1fe2cb30ec8d3ad982f9d63ac8_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
1100	2026-09-08_b8b52c1fe2cb30ec8d3ad982f9d63ac8_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
1100	2026-09-08_b8b52c1fe2cb30ec8d3ad982f9d63ac8_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
1580	svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe
1580	svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe
1580	svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe
1580	svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe
4228	svchost_BCAABCABBBAABABBABCCCCAABCACAACAAAACCABABBBACAACCBAABCC.exe
4228	svchost_BCAABCABBBAABABBABCCCCAABCACAACAAAACCABABBBACAACCBAABCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	2026-09-08_b8b52c1fe2cb30ec8d3ad982f9d63ac8_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
Token: SeDebugPrivilege	1580	svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe
Token: SeDebugPrivilege	4228	svchost_BCAABCABBBAABABBABCCCCAABCACAACAAAACCABABBBACAACCBAABCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 3488	1100	2026-09-08_b8b52c1fe2cb30ec8d3ad982f9d63ac8_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	92
PID 3488 wrote to memory of 2008	3488	cmd.exe	94
PID 1100 wrote to memory of 5392	1100	2026-09-08_b8b52c1fe2cb30ec8d3ad982f9d63ac8_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	95
PID 5392 wrote to memory of 1252	5392	cmd.exe	97
PID 1100 wrote to memory of 1124	1100	2026-09-08_b8b52c1fe2cb30ec8d3ad982f9d63ac8_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe	98
PID 1124 wrote to memory of 4088	1124	cmd.exe	100
PID 1580 wrote to memory of 1104	1580	svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-08_b8b52c1fe2cb30ec8d3ad982f9d63ac8_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_b8b52c1fe2cb30ec8d3ad982f9d63ac8_amadey_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCBABBBCBCCAAACCBAACAAABACACCBACACCBACACBCBABCBBCCAABAAACCCCCACCAABCBCBABBACACCBBBACABBABCBBACABBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCBABBBCBCCAAACCBAACAAABACACCBACACCBACACBCBABCBBCCAABAAACCCCCACCAABCBCBABBACACCBBBACABBABCBBACABBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAACCBBCCBCBACABABCCBAACBCACBBCAACABCAABBCABABCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe" start= auto displayName= "UserDataSvc_BAAACCBBCCBCBACABABCCBAACBCACBBCAACABCAABBCABABCCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAACCBBCCBCBACABABCCBAACBCACBBCAACABCAABBCABABCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe" start= auto displayName= "UserDataSvc_BAAACCBBCCBCBACABABCCBAACBCACBBCAACABCAABBCABABCCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAACCBBCCBCBACABABCCBAACBCACBBCAACABCAABBCABABCCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAACCBBCCBCBACABABCCBAACBCACBBCAACABCAABBCABABCCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe
1⤵
- Executes dropped EXE
PID:2536

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCABBBAABABBABCCCCAABCACAACAAAACCABABBBACAACCBAABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCABBBAABABBABCCCCAABCACAACAAAACCABABBBACAACCBAABCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 17517b69a5389707a68ad8ca3e39909402465fb91c40aa356105f7ecdf3f535a
MD5 032fc103c4a24446c8deb310e1e58d69
SHA1 181bb37ee07d39b80a9fc5b85d671a6ef18b38f8
SHA512 bf2312b1a918fe44cc8c3a90a370b2693ab1014724b4eb3e35dd1a3e47a90bcc852038859e3a87ece1eda2647134f2a99965f97822f540fec20c67df87e7dbe1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b890d7e967cdf5b90035d5e5a7b7c430ac15d75a204dce3c2b637285c55a0d7
MD5 ded6323752da7ae3378249ca36a3d623
SHA1 6f0a7acb81457dd6f209925507adb432fba8b07c
SHA512 77ecbe48633c71133fba3efb96d0690e367cf66ab079c8891576725ae326eff640ce9c8630a177a44478d1dde729183e04cdea356b9fb787252edf7b59814ad3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b04f1d704efe337b0371fa4b5e2eb1523137d461021741779f0960796afc7014
MD5 7c46141842b5260c35dd8a43840f3386
SHA1 9698ea61513c52ab3521355dda97d58db97fec1b
SHA512 42ab2a951420f4fcb08ddffb86be11b6a4964b3942679c34bc5084b1e0db1cb1daa465d3c0c05e45f6eecbeca246338b5582964b23c982ef93dd9e62685224f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d8a9a381997776804f2cfc677e3ad4fdabdece30b3618345fe7f96de7dc0df89
MD5 d258505f3c0e91d80d88faee658c4c11
SHA1 c7ff299d6334d77af9baff784cf5ef068115ae8d
SHA512 c031bd392d740bb4be904a1842003797628a8354ca7c5451824cf9c010819e1a44ea3a38b14c5b58b0702d7fca017ecc442d3758f639e305dcf7854c4463a890
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 61ee90c9657df6f826e28f0a926be0fa691b4337e678e3892de517ddbd741262
MD5 10ec615515897129b8e1644e5e1beafd
SHA1 1ec702be23ae7e114c6426864e21503ae15d5f3f
SHA512 ada6475961830cea19e341f03176ab7dbe570af9dba4ae14926f813210b9054667653033552153c99b637480824974fba9b9951d021dfee83a5ecd16325d9c5f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 86c713803e99ec5fe4ca5a7827bfeab11441cd13bb110c8fe2f9ae67d0c7ae67
MD5 45102feccd6f68fe1638a937eea46600
SHA1 854e6df98bcea5e04d8c91fd03673a4dc75fd34e
SHA512 460a60c3243f5ad07f677d05fa2a806fb29a961a3fdf4f80a8690f54c51f384c936d6d04cea6968cf0f069067b28f9561e16e7cec43b71c7b9e5c2d5b2a4f958
MD5 SHA1 SHA512

Submit Download

svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBCCBCBBAACCCAACBACBBACCACABCACCBCBBABBCBACCACACCBA.exe
Size 13.0MB
SHA256 5e6af9a0f9625b406834de49bf3fe817b92208a4d6f6d90280358ce5068d784e
MD5 b8b52c1fe2cb30ec8d3ad982f9d63ac8
SHA1 181d067ad9d7c5ad3925c8c9325b3b2e4f036e5c
SHA512 a780500fa42633279a2d6e38c34df2a1abd3e84e487de5b605661ee1110cd7e1941843a87b5bb038c6e7db0cca4115e3a10a2633b7b1fcc9ba2e1dac16776a8c
SSDEEP 49152:U+E7+EI+ES+ES+E7+EI+ES+ES+E7+EWX+E7+EI+ES+ES+E7+EI+ES+ES+E7+EWXf:O/fh6ImzzJoDfuBcMv+A73XAf
TLSH
T135D65B05F98740B1D91B51B04CCBE3BF8630BB1587228EE7EB4D8B5BB923BE15835256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 ab874167f0dce410f8efe4e4a4446169b92ce57c1c7781a3eeba8ae6b6739669
MD5 c58c994b9e3c60d3505df8d4fd1d9e95
SHA1 4a49106f0b9e088e86700c1975b144f082502ca5
SHA512 88cfb15a54c653776025cb00c7b8204252e31d3d2bc1ab811b8eacac1ce9aee988d3678bbb1a9739165951b88757d7c1608692600b843fa6a6957238730892e8
TLSH
T1A911E7A1F065D863F1322C865617EB461CB837DBACBCEB2812495B18FB59C36CE154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1100-6-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/1580-35-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/1580-22-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/2536-66-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/4228-72-0x0000000000660000-0x0000000000681000-memory.dmp

Download