0a95cdb6bbfbfbaef3fef202d0fd96c90ab65c60624a01675659fffde671987b

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-18_5bdc3543d32e6d9ba11503d4b07ac7dc_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
Size 1.4MB
Sample261018-rdwfcsbc67
SHA256 0a95cdb6bbfbfbaef3fef202d0fd96c90ab65c60624a01675659fffde671987b
MD5 5bdc3543d32e6d9ba11503d4b07ac7dc
SHA1 797f688e80a83cb84df559681578f46f612c9ea3
SHA512 3b0acf8e509b7b861d2578454f8e15e58b6948d41fe214cdb112dae6209dc985e3404ca7a8cbebbc08796fb6873ce0ef0a6bfa2c4942b67801b06790ccb4c953
SSDEEP 24576:m9+EM0q9+EM0p1afDd70iTWC7Exqatgl8bw4LOsDFncLmKDZOSzXFZt:U+ES+EruDd79WCSqatglSEzN
TLSH
T163659E21F7808072E1B20172896BD3756E79B5211F2586DFA3885B3E6E727D0BB72713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4728	svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe
4224	svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe
5060	svchost_ACBCCCBBAACBACBBCBABABBBCCACBAAABAAAAABBCACCCABCABCBBBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBBCCBBBABBCBCBCAAACBBBCCBCCCABBBCACCACACABBCCABBBCAABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe"	2026-10-18_5bdc3543d32e6d9ba11503d4b07ac7dc_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BABCAAAACAACBBCAABCBCCBABCBBCABACBAACCCACCCCBCCBBAACACAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCCCBBAACBACBBCBABABBBCCACBAAABAAAAABBCACCCABCABCBBBA.exe"	svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4412	sc.exe
64	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1528	cmd.exe
4812	cmd.exe
4916	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCCCBBAACBACBBCBABABBBCCACBAAABAAAAABBCACCCABCABCBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-18_5bdc3543d32e6d9ba11503d4b07ac7dc_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4772	2026-10-18_5bdc3543d32e6d9ba11503d4b07ac7dc_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
4772	2026-10-18_5bdc3543d32e6d9ba11503d4b07ac7dc_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
4772	2026-10-18_5bdc3543d32e6d9ba11503d4b07ac7dc_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
4772	2026-10-18_5bdc3543d32e6d9ba11503d4b07ac7dc_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
4728	svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe
4728	svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe
4728	svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe
4728	svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	2026-10-18_5bdc3543d32e6d9ba11503d4b07ac7dc_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
Token: SeDebugPrivilege	4728	svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3472	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 1528	4772	2026-10-18_5bdc3543d32e6d9ba11503d4b07ac7dc_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe	99
PID 1528 wrote to memory of 3572	1528	cmd.exe	101
PID 4728 wrote to memory of 3108	4728	svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe	102
PID 4772 wrote to memory of 4812	4772	2026-10-18_5bdc3543d32e6d9ba11503d4b07ac7dc_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe	103
PID 4812 wrote to memory of 4412	4812	cmd.exe	105
PID 4772 wrote to memory of 4916	4772	2026-10-18_5bdc3543d32e6d9ba11503d4b07ac7dc_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe	106
PID 4916 wrote to memory of 64	4916	cmd.exe	108
PID 3108 wrote to memory of 4900	3108	notepad.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-18_5bdc3543d32e6d9ba11503d4b07ac7dc_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-18_5bdc3543d32e6d9ba11503d4b07ac7dc_amadey_coinminer_elex_glassworm_rugmi_smoke-loader_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCBBBBCBACCACBBABCBACCCCABBABABBABBCCBAABAACCCACABACCBCCBBCCACCACAAAABABCBCBCBBABAAACBABACAAABABCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCBBBBCBACCACBBABCBACCCCABBABABBABBCCBAABAACCCACABACCBCCBBCCACCACAAAABABCBCBCBBABAAACBABACAAABABCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACAACAABBBBCACBAAAABACAABBACBCCCBBBABAAACBCACCCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe" start= auto displayName= "UserDataSvc_BACAACAABBBBCACBAAAABACAABBACBCCCBBBABAAACBCACCCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACAACAABBBBCACBAAAABACAABBACBCCCBBBABAAACBCACCCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe" start= auto displayName= "UserDataSvc_BACAACAABBBBCACBAAAABACAABBACBCCCBBBABAAACBCACCCBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACAACAABBBBCACBAAAABACAABBACBCCCBBBABAAACBCACCCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACAACAABBBBCACBAAAABACAABBACBCCCBBBABAAACBCACCCBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:64

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe
1⤵
- Executes dropped EXE
PID:4224

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBBAACBACBBCBABABBBCCACBAAABAAAAABBCACCCABCABCBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBBAACBACBBCBABABBBCCACBAAABAAAAABBCACCCABCABCBBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b74b2f8de42d6192742c909bf3606eba6eff44ed0ea52de257962e8f5fcd1979
MD5 bedb5b3bea47f3a22faa66b789809576
SHA1 6618b88278de094a7e124885d8a839cc7ad4b460
SHA512 4af5a0da6958cd937cc655e8d3d665b5c99055e3a770a2b26e31de1c74a56fce79a6118c8995c9df49cce2abe45c777544ea1626029b4a541bb066854003c048
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 163f24cc429e8164721568ccca319118c46e9e2c2499cce94674199a9c206dc2
MD5 0dab070599acf0fd8d1f500bbe4e10f7
SHA1 a4dd9d3eaecf73c21768a74bb5835ec371662fd6
SHA512 198e77594004bf9ce8ff5a550d9e874d86d5ff4fb1398c23e064e54ce2fe3a67e6d66b72430e510df990710f6a3493bfe876fa8f90630ac707f2f4d82fa3fa9e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 516c5c4c69c0df9fd82f898c8834a5bd60e14abf45f786d7347ffa6a4a1c19d7
MD5 2e5b0fe5956460276527c90247e223e1
SHA1 a78feca57e239b7360d133a388970da548e818c0
SHA512 dc33e289a7cd4225106ad8fc732e3f573411fe75bfe2909d5498222b7556dba4f83a596c66b227eaf60c5b43a1648f64c81144cd51d1eb4e218e1b0d4c6606bc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 707391068b57c70c9089d7c81ef8395f87fb05d2e4f5aea577f90f09950f3c6b
MD5 754f366c8569380e7ae069d2b1b78c91
SHA1 b72ea234750112405964a99e33562242a310ab0d
SHA512 d55e4d5aadd611b3ae53ebec9adf2fc7477cc4754c2a27986cffe4f4f862443ed68be777801f181bbf7381cf5e1f23aed9a36eef6ad483b2c0bc37e7cd12a5c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 863885da2162dc24bafed52ded304f22067cf3c4f05073bc22452f9c27257bf8
MD5 057426cd7fb366e93b9f66d6bbcf463c
SHA1 8bedee5019101a1cd4f1d8f704b1f4d4dda0d129
SHA512 b6a146fbf4103c2d2b38060211c3fb3592bb73dd28f82cda2955dd6e332d64141a449d3475e320558ef49f066a1d4c73284bf2b35d141d4162f81a073f610fc5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9d8b9b9310c412b6c0dc5e1b796d965fa94afc73507fc31ecae3b8fcf90f4de8
MD5 0714aef8d7be8a731bef02a982524e04
SHA1 57fbb4311889397e30c64964022da83cf50b0dd8
SHA512 10e0a5f4d9a255848dbc733ede3222d5df3d6e4ca732532e127b76dfdd4f7f3df67b3d6d0a40075c8339ab2b388e3bf5c94bb4c6dc4ebbdf42f4424b840954cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 82ce95097ad10f01842865d774b6302a6d230df2551dbef7d1f52dd936662d88
MD5 0b5790e8dcd200de8638b9c3884ce929
SHA1 1dd5d7f8b7b4600ece084a1c10f1e12928dcb38c
SHA512 9586c27991566a4bc9967b428e28a223b863115a32d4d28f536ad5d0d9960e1665b9be811395daa9d401d8a4f880ada43aed11f806d695156b459a0684cf604c
MD5 SHA1 SHA512

Submit Download

svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBBBBBCBBCBBBBCCCCABCCCBAAABBBBBCAABAAAAACACABAACBBC.exe
Size 1.4MB
SHA256 0a95cdb6bbfbfbaef3fef202d0fd96c90ab65c60624a01675659fffde671987b
MD5 5bdc3543d32e6d9ba11503d4b07ac7dc
SHA1 797f688e80a83cb84df559681578f46f612c9ea3
SHA512 3b0acf8e509b7b861d2578454f8e15e58b6948d41fe214cdb112dae6209dc985e3404ca7a8cbebbc08796fb6873ce0ef0a6bfa2c4942b67801b06790ccb4c953
SSDEEP 24576:m9+EM0q9+EM0p1afDd70iTWC7Exqatgl8bw4LOsDFncLmKDZOSzXFZt:U+ES+EruDd79WCSqatglSEzN
TLSH
T163659E21F7808072E1B20172896BD3756E79B5211F2586DFA3885B3E6E727D0BB72713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3108-67-0x0000000002A00000-0x0000000002A01000-memory.dmp

Download

memory/4728-27-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/4728-40-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/4772-0-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/4772-8-0x0000000000950000-0x0000000000971000-memory.dmp

Download