b3d623657e2c24296c16cd970cae222d006f61991bf9a1b7f4a9de6373b25364

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_3bb65bc200d2a23983e2d8b9b9bad3b1_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Size 34.7MB
Sample260806-wsbfysgl3z
SHA256 b3d623657e2c24296c16cd970cae222d006f61991bf9a1b7f4a9de6373b25364
MD5 3bb65bc200d2a23983e2d8b9b9bad3b1
SHA1 1643f6006a5fb78ba9f4f45c0d400e98bf73afed
SHA512 fab13dfa41cc7cd8b2eebff223d510a52e8cdff7b7041466c44507368a0b6ca2f0d07215912ff891fd54f32f87ac4692a54a99342a443dde6585a8673395d26a
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUwFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUQ:i33333333sK33333333s8
TLSH
T10087E146FD8A80B0DC7A60304CE7E2374936BE3AC025CA9AF9CA77067F37E61541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c512-19.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5892	svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe
2668	svchost_BBBCBCBCAACBCCCAACCAACBCACCABCABBABACBBACCCCACCCBAACCAB.exe
3924	svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBAABBABCCAACCCCCBACAACCBBCBBBACCBBBABCABBAAACCABAACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe"	2026-08-06_3bb65bc200d2a23983e2d8b9b9bad3b1_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABCAACBCABCCACBCABCAAACACBCBABAACBAABCABBCCBACCACBCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCBCBCAACBCCCAACCAACBCACCABCABBABACBBACCCCACCCBAACCAB.exe"	svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5816	sc.exe
2940	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6012	cmd.exe
2108	cmd.exe
2184	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_3bb65bc200d2a23983e2d8b9b9bad3b1_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCBCBCAACBCCCAACCAACBCACCABCABBABACBBACCCCACCCBAACCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4476	2026-08-06_3bb65bc200d2a23983e2d8b9b9bad3b1_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
4476	2026-08-06_3bb65bc200d2a23983e2d8b9b9bad3b1_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
4476	2026-08-06_3bb65bc200d2a23983e2d8b9b9bad3b1_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
4476	2026-08-06_3bb65bc200d2a23983e2d8b9b9bad3b1_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
5892	svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe
5892	svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe
5892	svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe
5892	svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe
2668	svchost_BBBCBCBCAACBCCCAACCAACBCACCABCABBABACBBACCCCACCCBAACCAB.exe
2668	svchost_BBBCBCBCAACBCCCAACCAACBCACCABCABBABACBBACCCCACCCBAACCAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4476	2026-08-06_3bb65bc200d2a23983e2d8b9b9bad3b1_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Token: SeDebugPrivilege	5892	svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe
Token: SeDebugPrivilege	2668	svchost_BBBCBCBCAACBCCCAACCAACBCACCABCABBABACBBACCCCACCCBAACCAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 6012	4476	2026-08-06_3bb65bc200d2a23983e2d8b9b9bad3b1_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	92
PID 6012 wrote to memory of 824	6012	cmd.exe	94
PID 5892 wrote to memory of 548	5892	svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe	95
PID 4476 wrote to memory of 2108	4476	2026-08-06_3bb65bc200d2a23983e2d8b9b9bad3b1_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	98
PID 2108 wrote to memory of 5816	2108	cmd.exe	100
PID 4476 wrote to memory of 2184	4476	2026-08-06_3bb65bc200d2a23983e2d8b9b9bad3b1_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	101
PID 2184 wrote to memory of 2940	2184	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bb65bc200d2a23983e2d8b9b9bad3b1_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bb65bc200d2a23983e2d8b9b9bad3b1_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCAAABBBCCCBAACCBCCCCCBBACBABABCBACBACCACCACBCAACCCACAACABBBCCBBBBBCBBACCAABCCBBCABBCBCAACBABCBBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCAAABBBCCCBAACCBCCCCCBBACBABABCBACBACCACCACBCAACCCACAACABBBCCBBBBBCBBACCAABCCBBCABBCBCAACBABCBBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACBBBCBBCBBAABCABAACCBCCCCBCCCCACBCBCCCBBCBAABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe" start= auto displayName= "UserDataSvc_BAACBBBCBBCBBAABCABAACCBCCCCBCCCCACBCBCCCBBCBAABAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACBBBCBBCBBAABCABAACCBCCCCBCCCCACBCBCCCBBCBAABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe" start= auto displayName= "UserDataSvc_BAACBBBCBBCBBAABCABAACCBCCCCBCCCCACBCBCCCBBCBAABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACBBBCBBCBBAABCABAACCBCCCCBCCCCACBCBCCCBBCBAABAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACBBBCBBCBBAABCABAACCBCCCCBCCCCACBCBCCCBBCBAABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5892
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:548

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCBCAACBCCCAACCAACBCACCABCABBABACBBACCCCACCCBAACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCBCAACBCCCAACCAACBCACCABCABBABACBBACCCCACCCBAACCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe
1⤵
- Executes dropped EXE
PID:3924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7cafe91c10762741bf4d37761df55a434e358a3296fdfe06121cc49e49b4ffb5
MD5 5f2efc1cb88a7ebb4a5a20119a699ca2
SHA1 13121222467507f643f1e602cd4116ae105be779
SHA512 0cd7429a3477ab7863e85868ee199c026bd3515fa3dd04fc270ce3f3a7cbcb7a24e77a1e34da1a9aa30149c84a72c2b102aba21a5b6137036a010d2c12f84b37
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 84e44bea3e510e2788e4e1d14aacfca53ea7e51acd46599fa4213b0a3a6b0fd4
MD5 07876ccbebee0411b4b3fc4e6b1b57c1
SHA1 c7c3bece66c1a13cd41e800cec096480563661a4
SHA512 ee9c7cfff0897fdb1a52e3153c02e107bda50fd44b12a8dd617c889cf15da8cf07b9ba88fd493eae06b676a88b63cb9c3a4b15cacd694a29e89a355ce0fbdbbb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c90869aa074872273d867012f2fcf56702a726e69e685cdb2e7d71c3dae508be
MD5 86793233491f75e40c2d3082a829c7b3
SHA1 b856a8f120826fb9458e7a941920ca88d4aa5fff
SHA512 7612d26a1facac2e164e976dbffb6763e62869974e9b3d56b6157b6fe89a68560ce19f6221a089ac8d61bc3f518b97b9bef7e1f8f0c976662d9723805b2d1fbe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 920797df043c06fbd6189a74d11364505e1c54715ac2e4c6978da45f33235934
MD5 acac48f2184e59889c576b2922e8239c
SHA1 4ffafa7db7bd86629438e47c4f128106ad0b0dd4
SHA512 bc9c85533db65d788acb08eaaa433bf84c3fc4f3d40af9d98c1ca9f066f804483d02fd2c8d0a12994a9a7c4f4b76d175b722515eeda5c098483784d8be485537
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5abf256637f12b5d4c4e9279e0fc0fb164af92844fa9c522cfc62f4bb1907759
MD5 2279319acea4ce654980846da77fe45a
SHA1 49e8b900700f3f0610cf0c7e56443fc1c74bb2cd
SHA512 1705ef8a54c0b5e2371129fe2fb3af41b97e71d6fa60d24a9dde33759b18513468f8a23c6d5cdb7abdb0b7199d543a5e0b32e8004d058d5b8b0d606b3598b22d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4ac9ccb3551877831262115f7e165f5f8909b35c477e0b8c1fc276239581af4e
MD5 c088b94c841eac7b32e1f79393ca6d54
SHA1 4501f7636ac4d530661345db2074a17c9cd34b95
SHA512 5e6c6480428cbd30f79e872e79eb75329d97e6916f2d10d993c71db0e3e027c830d41532950693911ca2c749aa737b79e2c5b1ec8cfdc3ced2bbb7d140fa1a25
MD5 SHA1 SHA512

Submit Download

svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACABAABCAACAAABAAAAAAABCCABCBBACCBABBACBCABCBABBCCC.exe
Size 34.7MB
SHA256 b3d623657e2c24296c16cd970cae222d006f61991bf9a1b7f4a9de6373b25364
MD5 3bb65bc200d2a23983e2d8b9b9bad3b1
SHA1 1643f6006a5fb78ba9f4f45c0d400e98bf73afed
SHA512 fab13dfa41cc7cd8b2eebff223d510a52e8cdff7b7041466c44507368a0b6ca2f0d07215912ff891fd54f32f87ac4692a54a99342a443dde6585a8673395d26a
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUwFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUQ:i33333333sK33333333s8
TLSH
T10087E146FD8A80B0DC7A60304CE7E2374936BE3AC025CA9AF9CA77067F37E61541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 dca21fe0cbe9bc292e0f4b066f17dba4e8df13fd1840150847a848d792b19b13
MD5 7ecd0da1213bfd5af60884537640e7b6
SHA1 be54040aa9f47cc188f9cac76240911f57bed065
SHA512 462039db213ab456fd8bb0ee31c6f37257c3996bd284de86118b29316705cc13e8289ae4b5c4225a1b0b774cdc3012453b5e651b4b0fe5728c49d693a51e2db8
TLSH
T174116DA4E1EE98A7F432284A5A3D9D9208A536CE9C5CAE55A304429873A5C314F158E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2668-79-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/3924-80-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/4476-0-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/4476-7-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/5892-34-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/5892-24-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download