8ed8e3d24f94ea3b826c21d7dd5cad9c0201ce5b3f5deaa2ddddb4c52043fb15

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_2322f01047d40e3ca6484a3409263ecc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 12.9MB
Sample260910-hsnvdsswbt
SHA256 8ed8e3d24f94ea3b826c21d7dd5cad9c0201ce5b3f5deaa2ddddb4c52043fb15
MD5 2322f01047d40e3ca6484a3409263ecc
SHA1 f324e132642d4c4bc8f2c1b6a1175197d70959d3
SHA512 488281f9f9509bb7c1328ffa04ac7f32977e1e78c9f98178168ec72771ae4a973c44ee83fd828cf514173242dc75f77a94967eeda6f106ae66757397c21d1cb8
SSDEEP 98304:smmemmemmemmemmemmemmemmemmP/fh6ImzzJoDfuBcMv+A73XAR:+Hh6ImzD+FR
TLSH
T1EDD66C85F98740F2E52301714CABD2FF5630BD148F21CBEBE684A76EA933BD05632656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
608	svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe
3424	svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe
3512	svchost_AACACBCCBCBACBBCABBACBACCBACBBCAAACABBBBAAAAAACBBBBABAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCBABACABCACABBCABBBCBAAAABBCCAACCAABACBBABABCAACBCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe"	2026-09-08_2322f01047d40e3ca6484a3409263ecc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABACBCCBCBCBBACABBCACBCBBCACAABACABAACBBAACACAABABABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACACBCCBCBACBBCABBACBACCBACBBCAAACABBBBAAAAAACBBBBABAB.exe"	svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4804	sc.exe
4628	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4112	cmd.exe
5992	cmd.exe
3240	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_2322f01047d40e3ca6484a3409263ecc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACACBCCBCBACBBCABBACBACCBACBBCAAACABBBBAAAAAACBBBBABAB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2176	2026-09-08_2322f01047d40e3ca6484a3409263ecc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2176	2026-09-08_2322f01047d40e3ca6484a3409263ecc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2176	2026-09-08_2322f01047d40e3ca6484a3409263ecc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
2176	2026-09-08_2322f01047d40e3ca6484a3409263ecc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
608	svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe
608	svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe
608	svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe
608	svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	2026-09-08_2322f01047d40e3ca6484a3409263ecc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	608	svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 4112	2176	2026-09-08_2322f01047d40e3ca6484a3409263ecc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	92
PID 4112 wrote to memory of 3672	4112	cmd.exe	94
PID 608 wrote to memory of 5032	608	svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe	95
PID 2176 wrote to memory of 5992	2176	2026-09-08_2322f01047d40e3ca6484a3409263ecc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	96
PID 5992 wrote to memory of 4804	5992	cmd.exe	98
PID 2176 wrote to memory of 3240	2176	2026-09-08_2322f01047d40e3ca6484a3409263ecc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	99
PID 3240 wrote to memory of 4628	3240	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-08_2322f01047d40e3ca6484a3409263ecc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_2322f01047d40e3ca6484a3409263ecc_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCAAAAAAAAACBAACAABCCCCAACBBAABBAAACBABBBABCACAAAABCACCACBCACCCACABBBBAABCCABCBAAAABCCBBAAACBCBCBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCAAAAAAAAACBAACAABCCCCAACBBAABBAAACBABBBABCACAAAABCACCACBCACCCACABBBBAABCCABCBAAAABCCBBAAACBCBCBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCACCCCCBBBBACBCBAAAACABCAABAABCACABBACCCBAABACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe" start= auto displayName= "UserDataSvc_BACCACCCCCBBBBACBCBAAAACABCAABAABCACABBACCCBAABACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCACCCCCBBBBACBCBAAAACABCAABAABCACABBACCCBAABACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe" start= auto displayName= "UserDataSvc_BACCACCCCCBBBBACBCBAAAACABCAABAABCACABBACCCBAABACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCACCCCCBBBBACBCBAAAACABCAABAABCACABBACCCBAABACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCACCCCCBBBBACBCBAAAACABCAABAABCACABBACCCBAABACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4628

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe
1⤵
- Executes dropped EXE
PID:3424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBCCBCBACBBCABBACBACCBACBBCAAACABBBBAAAAAACBBBBABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBCCBCBACBBCABBACBACCBACBBCAAACABBBBAAAAAACBBBBABAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8febfe70b56018ce173865c19fc271f60e6ce0c2c36e22ce226576b145e4096c
MD5 30791f8ee84f74d78245ba38b0efc7e9
SHA1 5cec3f7fd96f0bd22fd5f3a10d124e221b16e7b1
SHA512 04c7adf5a19b582306edaef8a91b9db96c6b5fdda562fc47ca9020b15c9f5405d8289826103797344c56d3c76524550877938fbb2bf5c064966a8af1eb918995
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4466fd360bcc52c4ce520f0242bd250c6ff4ff3580529198af7caa3f31c55e26
MD5 b63cd5a2d04f9fac69c88d322a6042e8
SHA1 487869ce217971a42e326dacbe1e28b4a8557e1b
SHA512 35d8a6af8128435ca2b99094abbf9665e3f80bed7b421177a0f11d23a74c18e5b90683c579c0427010e6a391e280708d408edaf6065db3fe0b6bb1efde805878
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 06a8fac67e82134cc5da0373e48ede23b0d3478a42f8f0a3a181dfad131353c1
MD5 8d4f47bc25f0c00872d8bea079098aba
SHA1 7e6f3a0b8d673023bbf4beaa889fe18a05aa87fa
SHA512 cf219d3e9b9ce4a138dd7a8f087062abd9bc8ead3d4b66158da3e83fa09f83dc80e38cd658f8359b4bb969a8563f83ac9e249827d8be46cb750c6d7de443f6b1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 528e6f6adec2149fcff611ef3a81def850e96cae5558c29887e8a522bc858069
MD5 d9f8b06b2715cb51ffdcea3ad30396e7
SHA1 1c4b2744773d27617a42534bdd42803ae0c3f863
SHA512 7055c5b43b07c314df463149ebad27737a6eeb54be567674732d2cefa46c8d7eb896a432b76822b455b5ad871672db8a4908216eb00a72fb8a9022f67d50de05
MD5 SHA1 SHA512

Submit Download

svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAAACCABCCCBAACABCAACBBCBBABCACBBCBCBCCCBCBCCAAACB.exe
Size 12.9MB
SHA256 8ed8e3d24f94ea3b826c21d7dd5cad9c0201ce5b3f5deaa2ddddb4c52043fb15
MD5 2322f01047d40e3ca6484a3409263ecc
SHA1 f324e132642d4c4bc8f2c1b6a1175197d70959d3
SHA512 488281f9f9509bb7c1328ffa04ac7f32977e1e78c9f98178168ec72771ae4a973c44ee83fd828cf514173242dc75f77a94967eeda6f106ae66757397c21d1cb8
SSDEEP 98304:smmemmemmemmemmemmemmemmemmP/fh6ImzzJoDfuBcMv+A73XAR:+Hh6ImzD+FR
TLSH
T1EDD66C85F98740F2E52301714CABD2FF5630BD148F21CBEBE684A76EA933BD05632656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/608-24-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/608-37-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/2176-0-0x0000000000940000-0x0000000000961000-memory.dmp

Download

memory/2176-7-0x0000000000940000-0x0000000000961000-memory.dmp

Download