b2328b97e5c7c2f83fb14912b315611f3438511bbf6aec2fc52e909d8f85f63a

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_05ff9907195be4f6b58e0ce41591a903_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
Size 17.7MB
Sample260802-bthlfabd29
SHA256 b2328b97e5c7c2f83fb14912b315611f3438511bbf6aec2fc52e909d8f85f63a
MD5 05ff9907195be4f6b58e0ce41591a903
SHA1 65e6586ff2af0da1bbc03c20cc56f530f36a0f8f
SHA512 ce294da5a43fafdd5602285bf2e599289b9b45fbf5b55f92d740b5b45c26ab48eb6ea551da5b83a27d5480959413ddfa0d96e4d235ffbfd7080aa052d8d747e2
SSDEEP 98304:kFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdL2n7OhCIyM7pH:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUS
TLSH
T10F17F147FD8A40B0EC7A21304CE7E2374936BE3AC425CA8AB9CA77097F37E61541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c518-19.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5364	svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe
3668	svchost_CCCAAACBACACBCBBBABAAABBAAAACBBBCBBABCBCBBBBABCACBAAAAA.exe
6048	svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCABCBCAACCABBBCACCBBCCACCCABCAAABBCBCAAACBBBCBACBCBCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe"	2026-08-01_05ff9907195be4f6b58e0ce41591a903_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABBCABBBBACAAABCCCAACAACBBBBAACCBAACABBCBABAABBCBBCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCAAACBACACBCBBBABAAABBAAAACBBBCBBABCBCBBBBABCACBAAAAA.exe"	svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4632	sc.exe
4904	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3724	cmd.exe
2804	cmd.exe
4872	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_05ff9907195be4f6b58e0ce41591a903_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCAAACBACACBCBBBABAAABBAAAACBBBCBBABCBCBBBBABCACBAAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2512	2026-08-01_05ff9907195be4f6b58e0ce41591a903_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
2512	2026-08-01_05ff9907195be4f6b58e0ce41591a903_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
2512	2026-08-01_05ff9907195be4f6b58e0ce41591a903_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
2512	2026-08-01_05ff9907195be4f6b58e0ce41591a903_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
5364	svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe
5364	svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe
5364	svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe
5364	svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe
3668	svchost_CCCAAACBACACBCBBBABAAABBAAAACBBBCBBABCBCBBBBABCACBAAAAA.exe
3668	svchost_CCCAAACBACACBCBBBABAAABBAAAACBBBCBBABCBCBBBBABCACBAAAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2512	2026-08-01_05ff9907195be4f6b58e0ce41591a903_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
Token: SeDebugPrivilege	5364	svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe
Token: SeDebugPrivilege	3668	svchost_CCCAAACBACACBCBBBABAAABBAAAACBBBCBBABCBCBBBBABCACBAAAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 3724	2512	2026-08-01_05ff9907195be4f6b58e0ce41591a903_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe	92
PID 3724 wrote to memory of 2880	3724	cmd.exe	94
PID 5364 wrote to memory of 1472	5364	svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe	95
PID 2512 wrote to memory of 2804	2512	2026-08-01_05ff9907195be4f6b58e0ce41591a903_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe	98
PID 2804 wrote to memory of 4632	2804	cmd.exe	100
PID 2512 wrote to memory of 4872	2512	2026-08-01_05ff9907195be4f6b58e0ce41591a903_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe	101
PID 4872 wrote to memory of 4904	4872	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-01_05ff9907195be4f6b58e0ce41591a903_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_05ff9907195be4f6b58e0ce41591a903_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBACBCCCCBCAACBBCCCCBCAAACCCCBBCCBCCAAACACCACCACCCCABAABCBBAABAAAABACBAACAAACBBBBBCACCBACCCCBCAABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBACBCCCCBCAACBBCCCCBCAAACCCCBBCCBCCAAACACCACCACCCCABAABCBBAABAAAABACBAACAAACBBBBBCACCBACCCCBCAABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBCAABCBBCBBCACCCBCACCAACCCBBACBABCCCCBBBCBCBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe" start= auto displayName= "UserDataSvc_ABCBCAABCBBCBBCACCCBCACCAACCCBBACBABCCCCBBBCBCBBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBCAABCBBCBBCACCCBCACCAACCCBBACBABCCCCBBBCBCBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe" start= auto displayName= "UserDataSvc_ABCBCAABCBBCBBCACCCBCACCAACCCBBACBABCCCCBBBCBCBBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBCAABCBBCBBCACCCBCACCAACCCBBACBABCCCCBBBCBCBBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBCAABCBBCBBCACCCBCACCAACCCBBACBABCCCCBBBCBCBBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4904

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5364
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAACBACACBCBBBABAAABBAAAACBBBCBBABCBCBBBBABCACBAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAACBACACBCBBBABAAABBAAAACBBBCBBABCBCBBBBABCACBAAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe
1⤵
- Executes dropped EXE
PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6e4f9c019439bb8ae756166504e4d3a8615b5c0c9ebac89395a7bbf06b6abf46
MD5 7c1ea6c9101eca712e05253c38ab2506
SHA1 93542abde54a88d3883f45c35fe4ea805b1a622b
SHA512 f386167a2dc2c1ed2d8598134b4e73ad93dece674f1edd859737c72f76383c36d082f07efe07680b119265c90bfefaa593797298a8c4ac02ab12b215817a5b60
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e0ac735ff9506f9f37c24da7265dba65ba9c05dc66e25da52796b96ba2fc957d
MD5 a0deaecd571287e3a0f89cb5d4d99880
SHA1 b39a42d01da3bdd7e48e5f6fd2c88fff9083667f
SHA512 423de35b741f83f95c19da6f2e917686ea692f9169244254a3fcd6062a859385f52f58289adbac875c8382fa60ac3d5e6f52ae6459f8125717c41ae4d21f30f1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d208e0a928082a761c75504141215d4f9478fb06488a6f9e15835153a4947cd9
MD5 1751be57160702fffd6b1ebaa1c67fc8
SHA1 8dba2301102feabbc443f1721c019e94ac9f4b09
SHA512 83604834835766a7a065f44616289815345d75c8c4cbbcc6e8d49400cef1ee4332bf65982ca4c7f42d2be016259085a0a96b3f3fdc34100c73f81ee5248f5279
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5bf93b2f9fbfd47bd17089ca25df0eabc80b409b9e33c7e3ac3d6bb7c9072f17
MD5 0b0a8c56bf9eaee90cb0d23aad1d9182
SHA1 f6085cddef3bd008a3c9631d3d5bee0d206e8f55
SHA512 52671835fe9fe3764943d495628eb9f7332382b26c673d1c9b013e219bf030e5909002abdc2245307ebc25b4ed8e91d4701ed399f442949c29bcd98f56a7d8f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f1df2ecd7cdc142bb6a30be69ccb275afea544c32798215964177270dc069aea
MD5 8d16ba5b47744683315a868fc9219734
SHA1 341fbd4b1ca423626dbbe26fb86c131add2c7659
SHA512 7c8d98f65746b344db649af67fb2290640347e38cd6d84ea1b9480bda89cf60037ab34d51a2a0a7ec7e7bb8b5eabbf52197b39583f59259a00a18f8d9cbe549d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fd64075c8c280f8b2f95933daf116b63335552345ec75f34acc66453e798df73
MD5 5a62c5b6d079563b40bfb803a28132da
SHA1 7350950d50f6bf0a2be9034d3295b48b31ba3128
SHA512 b7c61ad0665b5d71cdea6567c58ce10c3266e4ba84f8585c50143975a49066ba4def74f6e470402d1d1c8f05869f2ee76f8e2d415e7a71944fa86413f754bedf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6b3d3d6bdbfc024bfbf0a8687caf7c7b022471842c9b3a5be29ed6ed7d817788
MD5 eba93516c83a322f9bb503248c41fe4f
SHA1 148667f73fa54ad11e99431fa0fef0f36ccef804
SHA512 d49b892b7316f1262fef12083f6294bb7c86bbc61a611add8d61e057b68e5cfaf2398ca89c29b9303a80ad6a12e82ba1bf43c6dc1fcb1cbb07c889bb878a9efe
MD5 SHA1 SHA512

Submit Download

svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCBCBABBACBBCBCBABACCBCCCBABCABCABACBCBAABBBBACABBAB.exe
Size 17.7MB
SHA256 b2328b97e5c7c2f83fb14912b315611f3438511bbf6aec2fc52e909d8f85f63a
MD5 05ff9907195be4f6b58e0ce41591a903
SHA1 65e6586ff2af0da1bbc03c20cc56f530f36a0f8f
SHA512 ce294da5a43fafdd5602285bf2e599289b9b45fbf5b55f92d740b5b45c26ab48eb6ea551da5b83a27d5480959413ddfa0d96e4d235ffbfd7080aa052d8d747e2
SSDEEP 98304:kFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdLbFPdL2n7OhCIyM7pH:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUS
TLSH
T10F17F147FD8A40B0EC7A21304CE7E2374936BE3AC425CA8AB9CA77097F37E61541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6968ababf656f76c4a31ebf2c86014db6d204e6f66aa6c6503160ef6f417bcc8
MD5 73db08b429174eb57178afe92371284a
SHA1 bbc92610751f87abb67f60dc0859e9f017185664
SHA512 a177c51a67efa084a65dda40a8cbd78a9295d1fb08328700014468213d5404dc9b927b191f604360962603ef950949a2903babe0dd19b28283adca6b4a58f0c4
TLSH
T100112722D0F9E857F83328DFD35DE9C64CA8778758E46A54A24D4118A3EDC308D59CF2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2512-0-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/2512-7-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/3668-64-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/5364-33-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/6048-84-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download