7df6f8ba20cd8711eb82deae2a17d5def92fcf77e48ef0a0df0e7106258dab16

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/11/2026, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe
Size 16.7MB
Sample261108-c2c7cshs9x
SHA256 7df6f8ba20cd8711eb82deae2a17d5def92fcf77e48ef0a0df0e7106258dab16
MD5 f29b37eeaac5219f76a211efffbd131b
SHA1 c1be23a5790c5d2ebc96b767946084c600de11dd
SHA512 0399106beb4d6c903bb1f1852ccc631689b4f85be42da990c4a09faef513e0bf711d1c49bb976e87a92a6e225b2e183943012a58b799bbb4a73a88d2d238bd17
SSDEEP 196608:jbEl9yIGHbMXmQe61B6FNiQ2HPGxgG2DRdH:YoDUmQjT02HPGi
TLSH
T1AA077C90FDDB50B6DA03483048BB626F233469094B25DFC7D6447F6AF873AE20A37659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor defense_evasion discovery execution hacktool proxy tunnel

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4944	powershell.exe
2640	powershell.exe
236	powershell.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4100	icacls.exe

Reverse proxy tool: Chisel 1 IoCs

Chisel can be used to bypass network security and establish persistent backdoors. This open-source utility tunnels traffic through a public server to expose internal services behind NAT or firewalls.

hacktool tunnel proxy backdoor

resource	yara_rule
behavioral2/files/0x001400000001c430-50.dat	tool_chisel

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4520	tasklist.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5548	sc.exe
1568	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
3464	taskkill.exe
1680	taskkill.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4944	powershell.exe
4944	powershell.exe
2640	powershell.exe
2640	powershell.exe
236	powershell.exe
236	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeIncreaseQuotaPrivilege	4944	powershell.exe
Token: SeSecurityPrivilege	4944	powershell.exe
Token: SeTakeOwnershipPrivilege	4944	powershell.exe
Token: SeLoadDriverPrivilege	4944	powershell.exe
Token: SeSystemProfilePrivilege	4944	powershell.exe
Token: SeSystemtimePrivilege	4944	powershell.exe
Token: SeProfSingleProcessPrivilege	4944	powershell.exe
Token: SeIncBasePriorityPrivilege	4944	powershell.exe
Token: SeCreatePagefilePrivilege	4944	powershell.exe
Token: SeBackupPrivilege	4944	powershell.exe
Token: SeRestorePrivilege	4944	powershell.exe
Token: SeShutdownPrivilege	4944	powershell.exe
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeSystemEnvironmentPrivilege	4944	powershell.exe
Token: SeRemoteShutdownPrivilege	4944	powershell.exe
Token: SeUndockPrivilege	4944	powershell.exe
Token: SeManageVolumePrivilege	4944	powershell.exe
Token: 33	4944	powershell.exe
Token: 34	4944	powershell.exe
Token: 35	4944	powershell.exe
Token: 36	4944	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeIncreaseQuotaPrivilege	2640	powershell.exe
Token: SeSecurityPrivilege	2640	powershell.exe
Token: SeTakeOwnershipPrivilege	2640	powershell.exe
Token: SeLoadDriverPrivilege	2640	powershell.exe
Token: SeSystemProfilePrivilege	2640	powershell.exe
Token: SeSystemtimePrivilege	2640	powershell.exe
Token: SeProfSingleProcessPrivilege	2640	powershell.exe
Token: SeIncBasePriorityPrivilege	2640	powershell.exe
Token: SeCreatePagefilePrivilege	2640	powershell.exe
Token: SeBackupPrivilege	2640	powershell.exe
Token: SeRestorePrivilege	2640	powershell.exe
Token: SeShutdownPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeSystemEnvironmentPrivilege	2640	powershell.exe
Token: SeRemoteShutdownPrivilege	2640	powershell.exe
Token: SeUndockPrivilege	2640	powershell.exe
Token: SeManageVolumePrivilege	2640	powershell.exe
Token: 33	2640	powershell.exe
Token: 34	2640	powershell.exe
Token: 35	2640	powershell.exe
Token: 36	2640	powershell.exe
Token: SeDebugPrivilege	236	powershell.exe
Token: SeIncreaseQuotaPrivilege	236	powershell.exe
Token: SeSecurityPrivilege	236	powershell.exe
Token: SeTakeOwnershipPrivilege	236	powershell.exe
Token: SeLoadDriverPrivilege	236	powershell.exe
Token: SeSystemProfilePrivilege	236	powershell.exe
Token: SeSystemtimePrivilege	236	powershell.exe
Token: SeProfSingleProcessPrivilege	236	powershell.exe
Token: SeIncBasePriorityPrivilege	236	powershell.exe
Token: SeCreatePagefilePrivilege	236	powershell.exe
Token: SeBackupPrivilege	236	powershell.exe
Token: SeRestorePrivilege	236	powershell.exe
Token: SeShutdownPrivilege	236	powershell.exe
Token: SeDebugPrivilege	236	powershell.exe
Token: SeSystemEnvironmentPrivilege	236	powershell.exe
Token: SeRemoteShutdownPrivilege	236	powershell.exe
Token: SeUndockPrivilege	236	powershell.exe
Token: SeManageVolumePrivilege	236	powershell.exe
Token: 33	236	powershell.exe
Token: 34	236	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 4944	1212	2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe	90
PID 1212 wrote to memory of 2640	1212	2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe	92
PID 1212 wrote to memory of 236	1212	2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe	93
PID 1212 wrote to memory of 2100	1212	2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe	94
PID 1212 wrote to memory of 616	1212	2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe	95
PID 1212 wrote to memory of 1512	1212	2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe	96
PID 1212 wrote to memory of 5300	1212	2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe	97
PID 1212 wrote to memory of 3464	1212	2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe	98
PID 1212 wrote to memory of 1680	1212	2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe	100
PID 1212 wrote to memory of 5548	1212	2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe	101
PID 1212 wrote to memory of 1568	1212	2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe	102
PID 1212 wrote to memory of 4520	1212	2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe	103
PID 1212 wrote to memory of 4100	1212	2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe	104
PID 1212 wrote to memory of 4544	1212	2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_f29b37eeaac5219f76a211efffbd131b_chachi_cobalt-strike_coinminer_elex_frostygoop_glassworm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Set-MpPreference -ScanScheduleDay 8 -DisableCatchupFullScan $true -DisableCatchupQuickScan $true -MAPSReporting Disabled -SubmitSamplesConsent NeverSend -DisableIOAVProtection $true -ScanOnlyIfIdleEnabled $false"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4944
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\kernel'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:236
- C:\Windows\system32\reg.exe
  C:\Windows\Sysnative\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /f /v ScheduleDay /t REG_DWORD /d 8
  2⤵
  PID:2100
- C:\Windows\system32\reg.exe
  C:\Windows\Sysnative\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /f /v DisableCatchupFullScan /t REG_DWORD /d 1
  2⤵
  PID:616
- C:\Windows\system32\reg.exe
  C:\Windows\Sysnative\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /f /v DisableCatchupQuickScan /t REG_DWORD /d 1
  2⤵
  PID:1512
- C:\Windows\system32\reg.exe
  C:\Windows\Sysnative\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v SpyNetReporting /t REG_DWORD /d 0
  2⤵
  PID:5300
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM svc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:3464
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM srwsvc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:1680
- C:\Windows\SysWOW64\sc.exe
  sc stop kernels
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5548
- C:\Windows\SysWOW64\sc.exe
  sc delete kernels
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1568
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq srwsvc.exe" /NH
  2⤵
  - Discovers running processes
  - System Location Discovery: System Language Discovery
  PID:4520
- C:\Windows\SysWOW64\icacls.exe
  icacls C:\ProgramData\kernel\svc.exe /grant Everyone:F
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:4100
- C:\Windows\system32\reg.exe
  C:\Windows\Sysnative\reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /f /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1
  2⤵
  PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Credential Access

Discovery

Process Discovery

T1057

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

svc.exe

Path C:\ProgramData\kernel\svc.exe
Size 12.1MB
SHA256 27ee3f1733e81328e584120e5ab34d6513b622c71de32b81b0afba0d75d89f52
MD5 cdc86001a73fff011ac72f98b4b51562
SHA1 7a33a18378d8b326a2b77094d7e95e3d0051b170
SHA512 eb6accd26489de9dcf3490331745b5ad3513a90cabf15ce9ab0c239e78587abe85291923b40e6e27dd607869fd8a4fabfef3d32113cbafb7bc4dbcc242208a87
SSDEEP 98304:guMW8xvnuJfdITU3C3UDcZ1B6FNiImMjaxUqjPuGN4BcoLcUgGJ/EDRBX:XMXmQe61B6FNiQ2HPGxgG2DRd
TLSH
T1E1D67B80F89F54B5DA43087004BBA27F23306A054B28DFC7DA547F7AF877AA11A73599
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 9f89b81d560662dc8d8d0b2e2efb2b1c84d19f6dd444fc8abe5cb6bf0d4bf5dc
MD5 4d45fa835b309fb8f3446e40c2ce5fe8
SHA1 29e55813ea46d4d9425c91fdd4ddfb4a0c8f48a0
SHA512 5b3dc67f114d30da76c5660056db5e83f5c7236c050145b102dfc9dc8c4bf0f9a42fe6a6011152a977f8df67f8f822172e11ac4d97edd7017dd5f8f854efb32d
SSDEEP 384:t1eBImT1iBVfH14bnzTUEVX+geCnMramBL5IAkF4IaLWFa8PKE3vRbhNzPmlR+qu:neVZ6VfHi7XUEVX+4MVXIAkza1s5bhNr
TLSH
T160A2D578213F6DC7D8D226B010D10AF7FBE4D4899AB610D4FF1BDA2F4C91EB69A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 f6c267039b72e84d6da443e7fa3a1db01d7738161d38f7337082dbc90dfdd425
MD5 e4042d124e1b3c5ba0750d0ef9ab99a2
SHA1 508fadd7a27f4ba8698c6dfed4fa939975ce5e73
SHA512 9b0b6c186c331622b6ef532412cfd296d76723d4e8667dd160032a356b80e08dd9abb62e26883edae492fe7b18275c7d933284130aeec967b01d71bae00bf169
SSDEEP 384:8lSEboT1iBGTn16h6egacWo2gevRsWOEPiUDzVkIAkF4F/WOXJ/qBDK+lnHbhgUJ:8b0Z6GLYh63ZB2geN6UNkIAkaRXJ/MGo
TLSH
T1C2A2F628266F898FCE5160B800920796FBE4E185EBD592DBEB4BC91F2C459BD4F500F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3zqb4wpi.gzz.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3zqb4wpi.gzz.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/236-45-0x0000000071030000-0x000000007107C000-memory.dmp

Download

memory/236-41-0x0000000005E20000-0x000000000617B000-memory.dmp

Download

memory/2640-40-0x0000000074720000-0x0000000074EDC000-memory.dmp

Download

memory/2640-36-0x0000000071030000-0x000000007107C000-memory.dmp

Download

memory/2640-34-0x00000000059A0000-0x0000000005CFB000-memory.dmp

Download

memory/2640-31-0x0000000074720000-0x0000000074EDC000-memory.dmp

Download

memory/2640-30-0x0000000074720000-0x0000000074EDC000-memory.dmp

Download

memory/2640-29-0x0000000074720000-0x0000000074EDC000-memory.dmp

Download

memory/4944-11-0x0000000005AA0000-0x0000000005ABE000-memory.dmp

Download

memory/4944-26-0x0000000074720000-0x0000000074EDC000-memory.dmp

Download

memory/4944-15-0x0000000071030000-0x000000007107C000-memory.dmp

Download

memory/4944-18-0x0000000006FE0000-0x0000000007000000-memory.dmp

Download

memory/4944-19-0x0000000074720000-0x0000000074EDC000-memory.dmp

Download

memory/4944-20-0x0000000074720000-0x0000000074EDC000-memory.dmp

Download

memory/4944-21-0x0000000007060000-0x0000000007103000-memory.dmp

Download

memory/4944-22-0x00000000077D0000-0x0000000007E4C000-memory.dmp

Download

memory/4944-23-0x0000000007190000-0x00000000071AA000-memory.dmp

Download

memory/4944-24-0x0000000007200000-0x000000000720A000-memory.dmp

Download

memory/4944-25-0x0000000007400000-0x0000000007496000-memory.dmp

Download

memory/4944-13-0x0000000007020000-0x0000000007056000-memory.dmp

Download

memory/4944-28-0x0000000074720000-0x0000000074EDC000-memory.dmp

Download

memory/4944-14-0x0000000074720000-0x0000000074EDC000-memory.dmp

Download

memory/4944-12-0x0000000005ED0000-0x0000000005F1C000-memory.dmp

Download

memory/4944-0-0x0000000074732000-0x0000000074733000-memory.dmp

Download

memory/4944-10-0x0000000005B30000-0x0000000005E8B000-memory.dmp

Download

memory/4944-7-0x0000000005920000-0x0000000005986000-memory.dmp

Download

memory/4944-6-0x0000000005840000-0x00000000058A6000-memory.dmp

Download

memory/4944-5-0x0000000005040000-0x0000000005062000-memory.dmp

Download

memory/4944-4-0x0000000074720000-0x0000000074EDC000-memory.dmp

Download

memory/4944-3-0x0000000005080000-0x00000000056CA000-memory.dmp

Download

memory/4944-2-0x0000000074720000-0x0000000074EDC000-memory.dmp

Download

memory/4944-1-0x0000000002970000-0x00000000029A6000-memory.dmp

Download