3e1f7a231f019b57b72af4e085dcf41c9e9db5d905822e50a400dfeecdb37541

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_11ed8f31ade69bcb1ccfe8a7e4a5d835_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Size 17.7MB
Sample260802-bphewa1gld
SHA256 3e1f7a231f019b57b72af4e085dcf41c9e9db5d905822e50a400dfeecdb37541
MD5 11ed8f31ade69bcb1ccfe8a7e4a5d835
SHA1 93f30d4131d5397b2cd0cb45df0326cdddc444f5
SHA512 50b88d447941c860790de59fd52721f5efca8b053ab691a6b4b06be9e62615ddfe1598478de2b1e227d86ad11831be212b0ac741478095324e66db53973e52d0
SSDEEP 98304:kFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdL2n7OhCIy+:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSU+
TLSH
T1DD17E147FD8A80B0DC7A60304CE7E2774932BE3AC425CA8AB9C97B067F37E61541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c561-20.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c561-20.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4112	svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe
5980	svchost_BAACABCCCAACACABAAABACCBACAACABBCCABCCACCBBBCACAABAACAB.exe
932	svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBACCBAAACBCCBBACBCBCBAAABACCBCBACCBAAACBCCCCAACACBACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe"	2026-08-01_11ed8f31ade69bcb1ccfe8a7e4a5d835_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCCACACACBBABBACBBCBCACBAACCACACACCBBCBCCBCBBBCBAAAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACABCCCAACACABAAABACCBACAACABBCCABCCACCBBBCACAABAACAB.exe"	svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5988	sc.exe
3536	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1740	cmd.exe
3548	cmd.exe
6092	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACABCCCAACACABAAABACCBACAACABBCCABCCACCBBBCACAABAACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_11ed8f31ade69bcb1ccfe8a7e4a5d835_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2984	2026-08-01_11ed8f31ade69bcb1ccfe8a7e4a5d835_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
2984	2026-08-01_11ed8f31ade69bcb1ccfe8a7e4a5d835_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
2984	2026-08-01_11ed8f31ade69bcb1ccfe8a7e4a5d835_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
2984	2026-08-01_11ed8f31ade69bcb1ccfe8a7e4a5d835_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
4112	svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe
4112	svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe
4112	svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe
4112	svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe
5980	svchost_BAACABCCCAACACABAAABACCBACAACABBCCABCCACCBBBCACAABAACAB.exe
5980	svchost_BAACABCCCAACACABAAABACCBACAACABBCCABCCACCBBBCACAABAACAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	2026-08-01_11ed8f31ade69bcb1ccfe8a7e4a5d835_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Token: SeDebugPrivilege	4112	svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe
Token: SeDebugPrivilege	5980	svchost_BAACABCCCAACACABAAABACCBACAACABBCCABCCACCBBBCACAABAACAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 6092	2984	2026-08-01_11ed8f31ade69bcb1ccfe8a7e4a5d835_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	92
PID 6092 wrote to memory of 2004	6092	cmd.exe	94
PID 4112 wrote to memory of 5724	4112	svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe	95
PID 2984 wrote to memory of 1740	2984	2026-08-01_11ed8f31ade69bcb1ccfe8a7e4a5d835_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	98
PID 1740 wrote to memory of 5988	1740	cmd.exe	100
PID 2984 wrote to memory of 3548	2984	2026-08-01_11ed8f31ade69bcb1ccfe8a7e4a5d835_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	101
PID 3548 wrote to memory of 3536	3548	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-01_11ed8f31ade69bcb1ccfe8a7e4a5d835_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_11ed8f31ade69bcb1ccfe8a7e4a5d835_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACACCABBBBCBCBBACBABBAAAAABCBBCCACBCBAACBCABBBABCABCCBBBBBCABBCCBCCAACCBABBAABCACBCCCABBAAAABCABBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACACCABBBBCBCBBACBABBAAAAABCBBCCACBCBAACBCABBBABCABCCBBBBBCABBCCBCCAACCBABBAABCACBCCCABBAAAABCABBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBBBACAABAABBACBCCCCAAACBCABBCCCBACACBCAAAABCACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe" start= auto displayName= "UserDataSvc_ACCBBBACAABAABBACBCCCCAAACBCABBCCCBACACBCAAAABCACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBBBACAABAABBACBCCCCAAACBCABBCCCBACACBCAAAABCACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe" start= auto displayName= "UserDataSvc_ACCBBBACAABAABBACBCCCCAAACBCABBCCCBACACBCAAAABCACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBBBACAABAABBACBCCCCAAACBCABBCCCBACACBCAAAABCACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBBBACAABAABBACBCCCCAAACBCABBCCCBACACBCAAAABCACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3536

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5724

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCCCAACACABAAABACCBACAACABBCCABCCACCBBBCACAABAACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCCCAACACABAAABACCBACAACABBCCABCCACCBBBCACAABAACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5980

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe
1⤵
- Executes dropped EXE
PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7ebb552b829201cb76aeff9e4c398b03fa21b82fc490add8fdb30a8274ff3c29
MD5 5b3921928a3c5560a98000c732f7b1ad
SHA1 4d272500f9d6d5d2d3151c3a1d607b359262dd42
SHA512 e8c6672580a84d159c90761bc6f173305b0688aa3ff9e2bbc87b3367ba1dbc7d23a0aa52183122f39448207f7b7fb397a3e5f4d707619b6be0c8c4ae2ea1b20e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9637570ea800ab9c26bfe666cbfcd28e1376efcd9215bb809050a2ac479064ca
MD5 868af2827fc9250599ff14cf87671b4a
SHA1 078e5907a4ba95dbab02664581eb66ea4eb4e657
SHA512 618a81ea6dd6c0e25c3c65393e0dfea0189201170c23146801a0a58f0ab76b23552582f5da247f3bb63b3161ab99856f9407a81cc84ed8f8482ddd0b07d36e31
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6616b95746a35f089284fbe78bbec218fbe4ab9aa6e8cf378ced01276e514167
MD5 32834e3c77b93d129b58a2e96e3fbdab
SHA1 0a9f10f388aea3cad708271d572cf4d74bd56d65
SHA512 c714847932cbf16303d545c647acef54950da8da8757e6938598da344beb703d635af710eec5eb9cdeddd2878dea1705c2323fee5e803bf57a5d5bea952e2595
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4f129a976f141b9873ca3f562208b98752be7e3f4258deb4e92953e16cb5d073
MD5 59fe359be798f3d40b93fdd1a7d278c9
SHA1 2cbf4c1e3073b4f369877502a33242d9a60fc2c4
SHA512 034679e6975531d54b23e0361910c63102f1d492d0856d4ce8fc30a4c1a98c3f28dc6739bc3bd3534ed780aff56c6d7deafebc19d7a54b01fbf0e5100edcc62c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bbae2043e88364e2898aa14cb1dcf765eecf62712063e876f941002934f7d030
MD5 e3a574796c8b48a5ec1cb6325d073f5d
SHA1 a26d8cbfec730be5436851966a62982f169ba622
SHA512 8a1a3de193ca2e25b9a2c58713d6a8f6fccbfd34d86cb25a4af03002d8051fea002cc7b7325a5e661f1ec83d97dff2742e0195a4eafc1db1a1d69a30a37cf95a
MD5 SHA1 SHA512

Submit Download

svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABCCABACABACAABCBACCCCBCBABCAACCCABAACCBCBABCACBC.exe
Size 17.7MB
SHA256 3e1f7a231f019b57b72af4e085dcf41c9e9db5d905822e50a400dfeecdb37541
MD5 11ed8f31ade69bcb1ccfe8a7e4a5d835
SHA1 93f30d4131d5397b2cd0cb45df0326cdddc444f5
SHA512 50b88d447941c860790de59fd52721f5efca8b053ab691a6b4b06be9e62615ddfe1598478de2b1e227d86ad11831be212b0ac741478095324e66db53973e52d0
SSDEEP 98304:kFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdL2n7OhCIy+:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSU+
TLSH
T1DD17E147FD8A80B0DC7A60304CE7E2774932BE3AC425CA8AB9C97B067F37E61541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f84f193f1009971b33b163bd32b3630d912ecf8efeb68c945a04a03a6e99d7fb
MD5 be7824e40d43f642f63fc10228d9a2ab
SHA1 0961953d39432d36ab43ebeff7b66393933e6a08
SHA512 2d0484299e57d468161f5379ae6e3af54e0622d6533024551665147d88f8c341f44855102e6f7f8e090f103d6dc75d64ed23618fede142f726b737e77b78b089
TLSH
T10211C87190B9E823F523348E942DBF464CE077AF9CA86E94534883186BB5822CD554F6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2984-0-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/2984-8-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/4112-24-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/4112-34-0x0000000000310000-0x0000000000331000-memory.dmp

Download