2cf77a4aca611c136f64399c0fe66d5b647a74209e6cadf58d59fc1591d3adc9

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Size 35.1MB
Sample260808-c68h3abc48
SHA256 2cf77a4aca611c136f64399c0fe66d5b647a74209e6cadf58d59fc1591d3adc9
MD5 ccfc2e8d9fc18f7ef14cb11e52ae6259
SHA1 93a30a66e8d3c78735c38100d159330c3743ddb4
SHA512 5238d272217554278a881caa446b0c22c91e21a4e6611c02640c883d21f482e25ac1ac1ece3af7603136744081d32de2a25d06f24ed18fd83c3f8129a63d0a04
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUwFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUub:i33333333sK33333333sq
TLSH
T1C787E146FD8680B0EC7A60304CE7E2374936BE3AC025CA9AF9CA77067F37E61541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002447d-15.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4248	svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe
4632	svchost_BAABCCABBBBBACBCAAAAACACBABBCBACBABBACBBACCAACBAACAABCA.exe
4928	svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BABABBABCAABBBBAABCACABCABCACCCABABAACAAABCCBABABCCBCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe"	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABBBCCABBBAACCCCCABABABBACCABCBABCBBBCCABBAACACCCCCCBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABCCABBBBBACBCAAAAACACBABBCBACBABBACBBACCAACBAACAABCA.exe"	svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4548	sc.exe
1040	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3804	cmd.exe
3096	cmd.exe
2444	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABCCABBBBBACBCAAAAACACBABBCBACBABBACBBACCAACBAACAABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1468	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3908	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
3908	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
3908	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
3908	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
4248	svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe
4248	svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe
4248	svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe
4248	svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3908	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Token: SeDebugPrivilege	4248	svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 2444	3908	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	97
PID 2444 wrote to memory of 1468	2444	cmd.exe	99
PID 4248 wrote to memory of 1900	4248	svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe	100
PID 1900 wrote to memory of 4568	1900	notepad.exe	101
PID 3908 wrote to memory of 3804	3908	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	105
PID 3804 wrote to memory of 4548	3804	cmd.exe	107
PID 3908 wrote to memory of 3096	3908	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	108
PID 3096 wrote to memory of 1040	3096	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCAAABAAABBACCACBCACACBCBCCACCCCBCABABCACCBCACCBBCBCACBACABBAAACACBCBCAACCBBABBBCCACACAACABAACAAABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCAAABAAABBACCACBCACACBCBCCACCCCBCABABCACCBCACCBBCBCACBACABBAAACACBCBCAACCBBABBBCCACACAACABAACAAABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABCACABCCAACCCCCBABCACBBCBAABACCAACBCACABCBACACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe" start= auto displayName= "UserDataSvc_CBABCACABCCAACCCCCBABCACBBCBAABACCAACBCACABCBACACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABCACABCCAACCCCCBABCACBBCBAABACCAACBCACABCBACACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe" start= auto displayName= "UserDataSvc_CBABCACABCCAACCCCCBABCACBBCBAABACCAACBCACABCBACACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABCACABCCAACCCCCBABCACBBCBAABACCAACBCACABCBACACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABCACABCCAACCCCCBABCACBBCBAABACCAACBCACABCBACACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4568

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCABBBBBACBCAAAAACACBABBCBACBABBACBBACCAACBAACAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCABBBBBACBCAAAAACACBABBCBACBABBACBBACCAACBAACAABCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe
1⤵
- Executes dropped EXE
PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed3aee834a797b1b91ed4e9df81bd3c210c0717735e478368f44511a3fe3fdcb
MD5 ac2954540e5288bc08c1c971c8f7e790
SHA1 82bfe72987aa2386dbd52996b8f8e0641b604b58
SHA512 ff0d2fd1b8299b3a5e2d83e2ab57a6d5c0b6d89a0739c0e57f3c41680db39251b661c3c662a91294386df41dd7717136515fb619afcdb2e30d3b6529db9eb5d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3ad49a4d394545567e11e746c1a62e05b855f2055e05fd7d22ded97f31b0fc0c
MD5 c629b0c4ae85d3661c2d1229e510907d
SHA1 e7a23e26851628b184c0f716949e4cbe3991f0b8
SHA512 2349b605af0e4c6a680fdded7b89ea1cf1499495ba1783018cf15372231e8f1b56cd45c24b10a45464e52d9d268791409a7c501029129a143b8899576d97950d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ea0ca32e681c7c45e903d238f1adb163f07d072268d334fdc83def4198c0699e
MD5 2c9d862c7fb772bd2f36b2b229f0d9b0
SHA1 22e3232fd6b08ae312578076ec86a660bf723f2b
SHA512 c42a1bc5bfc7a5202c0e6254379eeabf19038d9bed938066e07b8f619b7eb9980d47500bab3f243a76459bbaa9c4d7d7171bfdabe8dcd43a9a58826ab25b1652
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5c93246a6ef4ba2449ff47b3839c2bc7522ba994d8045571cc16c47d63b52a1d
MD5 92e9f587e5cd61696552436b51dbd641
SHA1 d33e5c480bc7ba2a2e8d9a7a9da34aa188291750
SHA512 7077f171b3dd59fdbcc20c0e72a989bd0cbe5f199c7d23939d84e150150a04310ff2a161140b67ef514cfb0088a55775c44d6ed1ed5f739bcfb34e6ae9bf5e26
MD5 SHA1 SHA512

Submit Download

svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBABCBCACACBBCABACBBCCAAAABACBACCBBAAACCCABBABBABA.exe
Size 35.1MB
SHA256 2cf77a4aca611c136f64399c0fe66d5b647a74209e6cadf58d59fc1591d3adc9
MD5 ccfc2e8d9fc18f7ef14cb11e52ae6259
SHA1 93a30a66e8d3c78735c38100d159330c3743ddb4
SHA512 5238d272217554278a881caa446b0c22c91e21a4e6611c02640c883d21f482e25ac1ac1ece3af7603136744081d32de2a25d06f24ed18fd83c3f8129a63d0a04
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUwFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUub:i33333333sK33333333sq
TLSH
T1C787E146FD8680B0EC7A60304CE7E2374936BE3AC025CA9AF9CA77067F37E61541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1900-79-0x0000000002680000-0x0000000002681000-memory.dmp

Download

memory/3908-24-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/3908-61-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/3908-36-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/3908-75-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/3908-0-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/3908-11-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/4248-52-0x0000000000720000-0x0000000000741000-memory.dmp

Download

memory/4248-37-0x0000000000720000-0x0000000000741000-memory.dmp

Download

memory/4248-76-0x0000000000720000-0x0000000000741000-memory.dmp

Download