415a7cb06873acf97b39c8ddf8ff0793b271ba3ac45ef90d7bea77c2f31443bd

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_108db11fe82bf56b3d94f309bed9a521_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Size 12.4MB
Sample260910-jb4d7ahp31
SHA256 415a7cb06873acf97b39c8ddf8ff0793b271ba3ac45ef90d7bea77c2f31443bd
MD5 108db11fe82bf56b3d94f309bed9a521
SHA1 2f9cd3898f0c05874d89030791eb3cd6d33d0912
SHA512 ee3f1b70cf052c74edbde3ac20abc9deb34be5b77641d64c50c9c53e26b5ca18dd97186e931f03c94566a45471682537a6dacd0c984fb658acfdfa83601f29c4
SSDEEP 49152:U+ES+ESdx+EST+ES+ESd2iw2u+ES+ESdx+EST+ES+ESd2iw2u+ES+ESdx+EST+EC:J/fh6ImzzJoDfuBcMv+A73XA6
TLSH
T1F6D66C04FADB44B1E967617048D7D37F8631BA118732CEDBE6488B2BAD23BE15834716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
3584	svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAACACCBCCBAABAABCCBAABCCCABBBBCBACAABBCAAACABCBACBBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe"	2026-09-08_108db11fe82bf56b3d94f309bed9a521_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4100	sc.exe
4188	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4704	cmd.exe
1168	cmd.exe
5068	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_108db11fe82bf56b3d94f309bed9a521_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5848	2026-09-08_108db11fe82bf56b3d94f309bed9a521_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5848	2026-09-08_108db11fe82bf56b3d94f309bed9a521_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5848	2026-09-08_108db11fe82bf56b3d94f309bed9a521_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
5848	2026-09-08_108db11fe82bf56b3d94f309bed9a521_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
3584	svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe
3584	svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5848	2026-09-08_108db11fe82bf56b3d94f309bed9a521_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
Token: SeDebugPrivilege	3584	svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5848 wrote to memory of 4704	5848	2026-09-08_108db11fe82bf56b3d94f309bed9a521_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	92
PID 4704 wrote to memory of 4304	4704	cmd.exe	94
PID 5848 wrote to memory of 1168	5848	2026-09-08_108db11fe82bf56b3d94f309bed9a521_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	95
PID 1168 wrote to memory of 4100	1168	cmd.exe	97
PID 5848 wrote to memory of 5068	5848	2026-09-08_108db11fe82bf56b3d94f309bed9a521_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe	98
PID 5068 wrote to memory of 4188	5068	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-09-08_108db11fe82bf56b3d94f309bed9a521_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_108db11fe82bf56b3d94f309bed9a521_cobalt-strike_coinminer_cryptbot_elex_glassworm_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBAAAABACCAACBACBBBACCABCBACCBCBBCAABACBBBAACCACCBABACABCCABCBBCBBBACBAAAAABCCBCCCCAABACCCBCABACCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBAAAABACCAACBACBBBACCABCBACCBCBBCAABACBBBAACCACCBABACABCCABCBBCBBBACBAAAAABCCBCCCCAABACCCBCABACCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABCCABABBBCBAABCBAABAAACACAABCCCCABBCAACABAACACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe" start= auto displayName= "UserDataSvc_ACABCCABABBBCBAABCBAABAAACACAABCCCCABBCAACABAACACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABCCABABBBCBAABCBAABAAACACAABCCCCABBCAACABAACACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe" start= auto displayName= "UserDataSvc_ACABCCABABBBCBAABCBAABAAACACAABCCCCABBCAACABAACACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABCCABABBBCBAABCBAABAAACACAABCCCCABBCAACABAACACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABCCABABBBCBAABCBAABAAACACAABCCCCABBCAACABAACACCC"
    3⤵
    - Launches sc.exe
    PID:4188

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3584

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe
1⤵
PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4fe9f43d9fd7e6a6e0ab35740c17a54124be45dbdfe3046947df2090387294f5
MD5 9811a4a9e82ffc2c866e10f94bfdaa18
SHA1 88b5bc09720a62fc6c9353883dadc384b6c5e079
SHA512 c82cf6a83d980de1fe576790aaefdf2aa9c463dc948bdefabc4fcc68fd1d40ff0c8e48d47f129a983e6b10cf5cd4104664365c8dda88dfbf3a3e78bf211804d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e493c502c139c661c8b572c07435ba40bf268ba48aef9224d199247c2b2f5fbf
MD5 85462bc8086a12d87bcf7311b3f11316
SHA1 2568f205f2051922ea70a79751dac3b70999fb48
SHA512 12b3e945bcb9d3217ab2aedf292010182095fe9a6f8a73cdf76ae7ecbd5033e1ed2ee71f2b583427db1903c6f725718259161dd4916048c26e26c80cd77d8246
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f73a2e3b5dd5ddbe7bd4e0cf940116ea2857ec1a1edae6b1d77659362364e4ea
MD5 2316e919f76414c0c300b2abe747fd38
SHA1 485cd96498e28f85815f3666dcb2f995b4bb16c4
SHA512 2fd71f50548fc9b14f964909b059ae15170793167287e45e1fa5581e7c75977215c5f4f17fc51474fb1252908813d4e7ac66551e8a1724c721205376e33efbda
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 47fff93d92a52a764978d3b8d98006c0ae851f0780a03dc84d3932672d238c41
MD5 f42921ae8497c0fecb642e34af233a59
SHA1 b033ab43ce3bde6edfeecb491c70f6ccf4c28b10
SHA512 022a92b9a1259eaf4597f72f07b592775b04c33edc8a271676448fe2cc99b616eb177b86f86e6d2dcd059cfaf25044979cbaf0c9087eb09dc3909006c82d45f7
MD5 SHA1 SHA512

Submit Download

svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe
Size 12.4MB
SHA256 415a7cb06873acf97b39c8ddf8ff0793b271ba3ac45ef90d7bea77c2f31443bd
MD5 108db11fe82bf56b3d94f309bed9a521
SHA1 2f9cd3898f0c05874d89030791eb3cd6d33d0912
SHA512 ee3f1b70cf052c74edbde3ac20abc9deb34be5b77641d64c50c9c53e26b5ca18dd97186e931f03c94566a45471682537a6dacd0c984fb658acfdfa83601f29c4
SSDEEP 49152:U+ES+ESdx+EST+ES+ESd2iw2u+ES+ESdx+EST+ES+ESd2iw2u+ES+ESdx+EST+EC:J/fh6ImzzJoDfuBcMv+A73XA6
TLSH
T1F6D66C04FADB44B1E967617048D7D37F8631BA118732CEDBE6488B2BAD23BE15834716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCAABBACCCCCCBBBACAABCCCBABCABCCAAAAABBCBBBACAACACA.exe
Size 11.1MB
SHA256 6a8ccb62e504a3214cb435c7b6c232cd58f4ac4410c9699eb3789fd2b70de681
MD5 e91cf09ad0b2e1c711f3d8248aa467fb
SHA1 70c621e9d7274071794c906c82f341aa334b9a86
SHA512 1c9ee1234373285e99efd624ad69d1d1c168299ac11e719389d0715a9ef7cdee65d8327818d06bd72aeb9d0f073e0b41501814c8f6ae29a7292e29c50ce2f287
SSDEEP 49152:U+ES+ESdx+EST+ES+ESd2iw2u+ES+ESdx+EST+ES+ESd2iw2u+ES+ESdx+EST+E0:J/fh6ImzzJoDfuBcMv+AL
TLSH
T1BCC64B05FADB04B0E967607048DBD37F8A717A118731CEEBE6488B2BAD23BE15835715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3584-25-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/3584-38-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/5848-0-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/5848-8-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download