171fb11fccd7b03f67eafcdeda0f721bfd7abb0746d9250ad57b031b4dba197e

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_3944241c6ec1a8b1f8e0d5ac1d879bc8_elex_stop.exe
Size 2.4MB
Sample260807-tr7fwsgg69
SHA256 171fb11fccd7b03f67eafcdeda0f721bfd7abb0746d9250ad57b031b4dba197e
MD5 3944241c6ec1a8b1f8e0d5ac1d879bc8
SHA1 4c52bc9026177558d69a8c48416ddfa941b3bbee
SHA512 2fa1cc241204168f0894dd670178845f16574e3508c4475d4d47547d0d1d89fd967fa8d080a00c58ec1541a814e3120e7aba5fe680812831289582d09ed6c30b
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCD:Jp7Dp7Dp7Dp7Dp75
TLSH
T14CC58C10B7818035F5B329728ABFE739552CB9714F6986CFE388072E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4200	svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe
4704	svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBABCBBBCBACBCBAACACCABACBBBCCBABBAABCCAABAACAAABCCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe"	2026-08-07_3944241c6ec1a8b1f8e0d5ac1d879bc8_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBACCACBACBACBBBCBCBCBAACBCBAABBCACAACABACAACABCABBCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACBCACAACAACACABCCABACACCBABCAAACCBACBABAAAACAAAAACA.exe"	svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2896	sc.exe
4924	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4812	cmd.exe
2816	cmd.exe
5552	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_3944241c6ec1a8b1f8e0d5ac1d879bc8_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3508	2026-08-07_3944241c6ec1a8b1f8e0d5ac1d879bc8_elex_stop.exe
3508	2026-08-07_3944241c6ec1a8b1f8e0d5ac1d879bc8_elex_stop.exe
3508	2026-08-07_3944241c6ec1a8b1f8e0d5ac1d879bc8_elex_stop.exe
3508	2026-08-07_3944241c6ec1a8b1f8e0d5ac1d879bc8_elex_stop.exe
4200	svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe
4200	svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe
4200	svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe
4200	svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3508	2026-08-07_3944241c6ec1a8b1f8e0d5ac1d879bc8_elex_stop.exe
Token: SeDebugPrivilege	4200	svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 2816	3508	2026-08-07_3944241c6ec1a8b1f8e0d5ac1d879bc8_elex_stop.exe	92
PID 2816 wrote to memory of 460	2816	cmd.exe	94
PID 3508 wrote to memory of 5552	3508	2026-08-07_3944241c6ec1a8b1f8e0d5ac1d879bc8_elex_stop.exe	95
PID 5552 wrote to memory of 2896	5552	cmd.exe	97
PID 3508 wrote to memory of 4812	3508	2026-08-07_3944241c6ec1a8b1f8e0d5ac1d879bc8_elex_stop.exe	98
PID 4812 wrote to memory of 4924	4812	cmd.exe	100
PID 4200 wrote to memory of 3652	4200	svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-07_3944241c6ec1a8b1f8e0d5ac1d879bc8_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_3944241c6ec1a8b1f8e0d5ac1d879bc8_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBACAACABACAABCBBABACAAACAABAAACCAAACCABACAACCAACBACAACCBBBABABCBBACBCCCBABACABCBBCCBACBBBCAACCACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBACAACABACAABCBBABACAAACAABAAACCAAACCABACAACCAACBACAACCBBBABABCBBACBCCCBABACABCBBCCBACBBBCAACCACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACABCBABACAABBBBCBBBCABABABABCABAAACCABAABAAABCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe" start= auto displayName= "UserDataSvc_BACABCBABACAABBBBCBBBCABABABABCABAAACCABAABAAABCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5552
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACABCBABACAABBBBCBBBCABABABABCABAAACCABAABAAABCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe" start= auto displayName= "UserDataSvc_BACABCBABACAABBBBCBBBCABABABABCABAAACCABAABAAABCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACABCBABACAABBBBCBBBCABABABABCABAAACCABAABAAABCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACABCBABACAABBBBCBBBCABABABABCABAAACCABAABAAABCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3652

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe
1⤵
- Executes dropped EXE
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 80576bfa00775bee6ca237f895138093bce08da11e9403afddfacfccd5d73535
MD5 9456e3ef09bf2e64bd5920efa1e79439
SHA1 7e0d7a1f656576d9ca73e5a05433da569d590613
SHA512 71f4b891737e12d2ddf38dc0714c1828e2a3eed39adb500269c5e2637705115c7d9f7a02a21da380a165875551bf3a0ec2b54a5629be96f31f04380a8e8a68c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5b7728b1f36db6f58fdb099a56d10bb4b0fd3b127b1c44ed1c316475dafe5f2b
MD5 93fed711e707ae38dbc1ba851f3ca13c
SHA1 ddd75cd0a258ec4b7d9fce12a9de3eb77be95ae6
SHA512 9db7d63bc6f27116740b7f643c1174757d5251319a4c53f299f4abdcc4e9393beaca7e7acc0e1a49a5a0269d9d3ff5ad85f668e0c18faf460012bf3f2ee58e2d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 70060e6420b3251dd5eaf9ff365c75d3ec281e265ae7add906de80ffb9f33fe7
MD5 1550da0a486e3472380df8fedb0845a5
SHA1 a813f1b16f028136a36a2722607f6d54a2d0e009
SHA512 9343e866b057a915b0261b84c6c4d2e8ccf11d9dee77f8e5dd28430a0ba30d55c346eaea6beb491c710ba99736470cdc52855c08466e90f14b8d46e6cff9cb9a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f7e6c7621158463ed806b6c8762fc983712f54fd071d26071ce0477d052eef9a
MD5 a9955c4230159447f3ec421d42c313df
SHA1 2bbf2c8e08969ac4ce7cb2b7b1a724db1b70c8a0
SHA512 83dc4bf901808a3406b84261239ad085501386b15365001b79b30981cecf4a3c09fbfff563dd4174f625dfc8831a680af893092eb31a6efb63769e44c5e6994e
MD5 SHA1 SHA512

Submit Download

svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCCBAABCBACBACAABABACCCBCACBCAAACBCCABACACCAAAAACAA.exe
Size 2.4MB
SHA256 171fb11fccd7b03f67eafcdeda0f721bfd7abb0746d9250ad57b031b4dba197e
MD5 3944241c6ec1a8b1f8e0d5ac1d879bc8
SHA1 4c52bc9026177558d69a8c48416ddfa941b3bbee
SHA512 2fa1cc241204168f0894dd670178845f16574e3508c4475d4d47547d0d1d89fd967fa8d080a00c58ec1541a814e3120e7aba5fe680812831289582d09ed6c30b
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCD:Jp7Dp7Dp7Dp7Dp75
TLSH
T14CC58C10B7818035F5B329728ABFE739552CB9714F6986CFE388072E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3508-0-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/3508-8-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/4200-24-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/4200-37-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download