fb223783e3497fc682ea4fea792837b3eb2ce17501968de987e35653ef1edfb2

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_5f3461d154ca3802180d9c4997993e91_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Size 17.0MB
Sample260731-3va2jaae96
SHA256 fb223783e3497fc682ea4fea792837b3eb2ce17501968de987e35653ef1edfb2
MD5 5f3461d154ca3802180d9c4997993e91
SHA1 6756e7a75d4b158a5b1765bd2ddd396b8f46c975
SHA512 5f2edf8a245e7266c3e289df1fa41b93f52aa3c462536c7be003f96729a5b0a9d90960ef83a8aab1b277c2688de11fdae8fd6d467e08002f329435c4595f0133
SSDEEP 98304:kFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdL2n7OhCIyt:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUt
TLSH
T1BA07E147FC8690B0DC3A64704CEBE2774936BE3AC0168A59F9CA7B067B37E61540F45A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5db-20.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4184	svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe
2092	svchost_CCBCABABBBBBCAACBACBCACBCACBABBBACCCBCBBCCACACCCBABCCBC.exe
5244	svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCBBACBCBCABAACACBCCBBCBBABCABCCBCCCCACCBCABCABACCBBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe"	2026-07-31_5f3461d154ca3802180d9c4997993e91_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCAABBAABCCCAACBAAAACCABCBCBAABCBCCCBCBBBBCCAACABBABBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCABABBBBBCAACBACBCACBCACBABBBACCCBCBBCCACACCCBABCCBC.exe"	svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4948	sc.exe
1492	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5776	cmd.exe
5104	cmd.exe
5160	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_5f3461d154ca3802180d9c4997993e91_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCABABBBBBCAACBACBCACBCACBABBBACCCBCBBCCACACCCBABCCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5716	2026-07-31_5f3461d154ca3802180d9c4997993e91_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
5716	2026-07-31_5f3461d154ca3802180d9c4997993e91_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
5716	2026-07-31_5f3461d154ca3802180d9c4997993e91_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
5716	2026-07-31_5f3461d154ca3802180d9c4997993e91_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
4184	svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe
4184	svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe
4184	svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe
4184	svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe
2092	svchost_CCBCABABBBBBCAACBACBCACBCACBABBBACCCBCBBCCACACCCBABCCBC.exe
2092	svchost_CCBCABABBBBBCAACBACBCACBCACBABBBACCCBCBBCCACACCCBABCCBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5716	2026-07-31_5f3461d154ca3802180d9c4997993e91_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Token: SeDebugPrivilege	4184	svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe
Token: SeDebugPrivilege	2092	svchost_CCBCABABBBBBCAACBACBCACBCACBABBBACCCBCBBCCACACCCBABCCBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5716 wrote to memory of 5776	5716	2026-07-31_5f3461d154ca3802180d9c4997993e91_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	91
PID 5776 wrote to memory of 5108	5776	cmd.exe	93
PID 4184 wrote to memory of 2884	4184	svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe	94
PID 5716 wrote to memory of 5104	5716	2026-07-31_5f3461d154ca3802180d9c4997993e91_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	97
PID 5104 wrote to memory of 4948	5104	cmd.exe	99
PID 5716 wrote to memory of 5160	5716	2026-07-31_5f3461d154ca3802180d9c4997993e91_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	100
PID 5160 wrote to memory of 1492	5160	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-31_5f3461d154ca3802180d9c4997993e91_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_5f3461d154ca3802180d9c4997993e91_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABACBCAABCABCCACABACABACACBCCBBAABCBABBCCAAAACCBBCBBAAACCAABBCBAABCABCCBACACAABACBABCACCCAACBBBCCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABACBCAABCABCCACABACABACACBCCBBAABCBABBCCAAAACCBBCBBAAACCAABBCBAABCABCCBACACAABACBABCACCCAACBBBCCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACABAABCCACCACACCABAABBAABCCBCBBABBABCABAACABCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe" start= auto displayName= "UserDataSvc_BBACABAABCCACCACACCABAABBAABCCBCBBABBABCABAACABCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACABAABCCACCACACCABAABBAABCCBCBBABBABCABAACABCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe" start= auto displayName= "UserDataSvc_BBACABAABCCACCACACCABAABBAABCCBCBBABBABCABAACABCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACABAABCCACCACACCABAABBAABCCBCBBABBABCABAACABCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5160
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACABAABCCACCACACCABAABBAABCCBCBBABBABCABAACABCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1492

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2884

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCABABBBBBCAACBACBCACBCACBABBBACCCBCBBCCACACCCBABCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCABABBBBBCAACBACBCACBCACBABBBACCCBCBBCCACACCCBABCCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe
1⤵
- Executes dropped EXE
PID:5244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e056f592caa956919fc19848e6e94e5abeb381a342a2efb26cb56ee006df8b87
MD5 d152ec15ab64737ac42e3c6ca381ff0c
SHA1 b77978cf9842f717b90cd8a420cc9387e85b1934
SHA512 cc53c66dac208f5e2f16666d392dd675b3a6bae672960baf253dc4c17ea22fa4f6dd812bdca90a9dd50181e28d403d26568d7e67481e3ad1606a6206e43c8824
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dfea5683bd7acab491a4a5f785bc4fdcba031698922d7abe46e445723a6be648
MD5 5a0b48bc0673967768b877c2ff05c1b8
SHA1 2cc2c792066de98ba3ee23184970c954be0bf53f
SHA512 bb295ae34762788707dd18f5c25080fd8f42ccb63110e0e3532fc5d3dc07c5f002fe21aaedc21cd4d2658b76061da49fe2c115b473f6eda5dca4e003986d4b9b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 95c8c50581d391895d7f28f2e50dc72b0e732a85df5ccdf19fdeb29b29242705
MD5 74e36f058b0132ac44d492791e2cee4e
SHA1 56f1bbeb484ded6dbddbf10287b180ca0a468765
SHA512 4fbbf86877b7e4fe45b7402786329bd4533b2f16d0dcf7431bb2094abe76569cbf78db43822e525e0915d333029fde944ca7cc78b97886e8bca397349b18600a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9688eaf39d6351b13b7179bf4ca739a24ccd03ec6d9f23bfb8d80a311d158e8b
MD5 c3fc1ceb10afb4e6e4a893b4c211037a
SHA1 e3b360b04cb7ec79041175326de962f80ef458ed
SHA512 2362a2844b788cf90da3ce03b221fe8b5ac5c1c00a68bf565fab0da26ee9a75368c8a3d24b3c27553477d91bbc1697eb4289d5dc672710ae719c5470011af356
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 35bb3b71e70cf0dd477c7587d3bbd8ac7d7c359d709e7f9ff04aed4a37eb58ac
MD5 25438fa8bab97ca3b5f06288dd1b3a36
SHA1 1410b3c51db6bf5f1e5545eaeb8ba3c9d7202505
SHA512 d923127489150dbad1b9c4f2dbecf9b40cc4a6704f1293241a996e3d9447b37a6e4c91275f900e7e852c1159ca8d1f11a69dbd6b2989229540fcb18728fbe4c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2cf7ce15c39d847c47f79c6eb09d7bf33ec23269b34b8f3635b37cc2d11ba937
MD5 3a03eea5faa49f7dcd1f2b5998edacd0
SHA1 fda75fa87561bd6efbe1b3c0996d6de12422e2ef
SHA512 c999db5c0ae9a715dd2253bfcf8db055f41a7eed91e06a81c35068d8341418c5503624856c76583e489ee662018f44d068ebc9ac2757c4cae6c3f3b972bfa86c
MD5 SHA1 SHA512

Submit Download

svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAABBACCBBBACACBBBCCBCAACABAACCBAABBBACAACACCBAAABBA.exe
Size 17.0MB
SHA256 fb223783e3497fc682ea4fea792837b3eb2ce17501968de987e35653ef1edfb2
MD5 5f3461d154ca3802180d9c4997993e91
SHA1 6756e7a75d4b158a5b1765bd2ddd396b8f46c975
SHA512 5f2edf8a245e7266c3e289df1fa41b93f52aa3c462536c7be003f96729a5b0a9d90960ef83a8aab1b277c2688de11fdae8fd6d467e08002f329435c4595f0133
SSDEEP 98304:kFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdL2n7OhCIyt:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUt
TLSH
T1BA07E147FC8690B0DC3A64704CEBE2774936BE3AC0168A59F9CA7B067B37E61540F45A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b2f4e7a0ecd61cbb5fe3104aa2e15dc33435cc6e5f3902a98a500ee453a297a9
MD5 c1a339f90f946b0775aff9c72fb2a8e9
SHA1 de879982c7411d68b9af589dfcfb9d260e5d8ccb
SHA512 000aa71d269edf3254c1787620138d05300f793a9e1ffb3a6e0755be4cbf31e768634962086ef59c751d4af823f19d54d81207397eaf6f430055a861258802ac
TLSH
T1CD112044E0F9D813E83324CF9A25BE430898339FED986E00278D421CBBA5C349E594E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2092-74-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/4184-34-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/5716-0-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/5716-8-0x0000000000670000-0x0000000000691000-memory.dmp

Download