2cf77a4aca611c136f64399c0fe66d5b647a74209e6cadf58d59fc1591d3adc9

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Size 35.1MB
Sample260808-c68h3abc48
SHA256 2cf77a4aca611c136f64399c0fe66d5b647a74209e6cadf58d59fc1591d3adc9
MD5 ccfc2e8d9fc18f7ef14cb11e52ae6259
SHA1 93a30a66e8d3c78735c38100d159330c3743ddb4
SHA512 5238d272217554278a881caa446b0c22c91e21a4e6611c02640c883d21f482e25ac1ac1ece3af7603136744081d32de2a25d06f24ed18fd83c3f8129a63d0a04
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUwFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUub:i33333333sK33333333sq
TLSH
T1C787E146FD8680B0EC7A60304CE7E2374936BE3AC025CA9AF9CA77067F37E61541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c58f-19.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5776	svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe
1272	svchost_CACACBCABAABCCACBABBACCBAAACCBAACABCABABCBCACCCBCBBCAAB.exe
3784	svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABACAABBBACBCABABCAAAABCBCAACBCBCBAABCBBBBCABABBCACACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe"	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBABAABBBACACBCBBAAAAAAAAABACABBBCCBCACCBAACAAABCABCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACACBCABAABCCACBABBACCBAAACCBAACABCABABCBCACCCBCBBCAAB.exe"	svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1804	sc.exe
4328	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
708	cmd.exe
2224	cmd.exe
5020	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACACBCABAABCCACBABBACCBAAACCBAACABCABABCBCACCCBCBBCAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5016	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
5016	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
5016	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
5016	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
5776	svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe
5776	svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe
5776	svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe
5776	svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe
1272	svchost_CACACBCABAABCCACBABBACCBAAACCBAACABCABABCBCACCCBCBBCAAB.exe
1272	svchost_CACACBCABAABCCACBABBACCBAAACCBAACABCABABCBCACCCBCBBCAAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
Token: SeDebugPrivilege	5776	svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe
Token: SeDebugPrivilege	1272	svchost_CACACBCABAABCCACBABBACCBAAACCBAACABCABABCBCACCCBCBBCAAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 5020	5016	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	92
PID 5020 wrote to memory of 1280	5020	cmd.exe	94
PID 5776 wrote to memory of 2856	5776	svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe	95
PID 5016 wrote to memory of 708	5016	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	98
PID 708 wrote to memory of 1804	708	cmd.exe	100
PID 5016 wrote to memory of 2224	5016	2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe	101
PID 2224 wrote to memory of 4328	2224	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_ccfc2e8d9fc18f7ef14cb11e52ae6259_coinminer_elex_glassworm_hijackloader_redline-stealer_rh.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAAACBCAABABABBABCAABACACBBCACCCBCCBCAABACBACACBCCBACBBBAABCCBACCACACACBBBABAABBCBBBCCBBCCABCBACCBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAAACBCAABABABBABCAABACACBBCACCCBCCBCAABACBACACBCCBACBBBAABCCBACCACACACBBBABAABBCBBBCCBBCCABCBACCBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAABCCABACCCAABCCCCBCACABABBBCAABCCAACCCCBBCCCABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe" start= auto displayName= "UserDataSvc_AAAABCCABACCCAABCCCCBCACABABBBCAABCCAACCCCBBCCCABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAABCCABACCCAABCCCCBCACABABBBCAABCCAACCCCBBCCCABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe" start= auto displayName= "UserDataSvc_AAAABCCABACCCAABCCCCBCACABABBBCAABCCAACCCCBBCCCABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAABCCABACCCAABCCCCBCACABABBBCAABCCAACCCCBBCCCABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAABCCABACCCAABCCCCBCACABABBBCAABCCAACCCCBBCCCABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4328

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBCABAABCCACBABBACCBAAACCBAACABCABABCBCACCCBCBBCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBCABAABCCACBABBACCBAAACCBAACABCABABCBCACCCBCBBCAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe
1⤵
- Executes dropped EXE
PID:3784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed3aee834a797b1b91ed4e9df81bd3c210c0717735e478368f44511a3fe3fdcb
MD5 ac2954540e5288bc08c1c971c8f7e790
SHA1 82bfe72987aa2386dbd52996b8f8e0641b604b58
SHA512 ff0d2fd1b8299b3a5e2d83e2ab57a6d5c0b6d89a0739c0e57f3c41680db39251b661c3c662a91294386df41dd7717136515fb619afcdb2e30d3b6529db9eb5d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3ad49a4d394545567e11e746c1a62e05b855f2055e05fd7d22ded97f31b0fc0c
MD5 c629b0c4ae85d3661c2d1229e510907d
SHA1 e7a23e26851628b184c0f716949e4cbe3991f0b8
SHA512 2349b605af0e4c6a680fdded7b89ea1cf1499495ba1783018cf15372231e8f1b56cd45c24b10a45464e52d9d268791409a7c501029129a143b8899576d97950d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a5efcd72f15345697562f620430fbc73922b7f4a0f9d599ba425f373c9f135b8
MD5 5603d075292a355fbf16dcfb2e555aae
SHA1 1a28ac97af7860aa0965b5e1ba960568d48f7266
SHA512 b773c1ff8e955298e161efbb81a2b09feaef7b5d71e06b76a19f90a10e506c248d9bceb751e5c7562c47d9371cd6b2bf4835628a9c3b206d634f1b90c1db77f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f34b33872fe222da567fe31ca114953fb9e086e1733b483174b2e7e57df5d32c
MD5 bdaa9a0f8761bee7bef095096fffea1b
SHA1 dc635d97f5fffe87b3fa4b6e9d9db1dd6732eacc
SHA512 1899b7ead98d454b8226281d5df4b1651f6f9857ae5049ced782cb8350db356f4d6ceb4588b3e990beafa266795166ecc6999925df21442a14a53a34c07328f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 81337527442ffad1c3de3756acae325ee4b68838dfdde3f220f0df90ff80fff2
MD5 ce0647a3f66776934104c1dce3467d43
SHA1 13e4df20d61883cdd34b0a21101f76a546553c60
SHA512 597921052c7d6f3260472a4ba009f90f4aa11b7654d1864f652cc028045cd29471455edc5fb2baa80aa78c772164f8c487f9b55eaac1fe1ad4bb4f28ac7a9d25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f2e2232f6f5496cca1689d17558ee9087f9c7d833d46b6c583b9656c3a8f3e1c
MD5 0df24aff7b1e638d3be5bf85ea986bde
SHA1 ef7f90a4b657762466e4978e6516d9b763eafcd8
SHA512 3b42d946a981f5331e15f7e1fed68cca480fcb2043c8d4fcee61861d60b9f2a2031567fe8e30427460c938ce32e51570ec80e4bfae546b1eb5f045c7a7a21b0a
MD5 SHA1 SHA512

Submit Download

svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBABBBACBAACCAAABABBCACCCCBAACBACCAABABACCAACCCBABC.exe
Size 35.1MB
SHA256 2cf77a4aca611c136f64399c0fe66d5b647a74209e6cadf58d59fc1591d3adc9
MD5 ccfc2e8d9fc18f7ef14cb11e52ae6259
SHA1 93a30a66e8d3c78735c38100d159330c3743ddb4
SHA512 5238d272217554278a881caa446b0c22c91e21a4e6611c02640c883d21f482e25ac1ac1ece3af7603136744081d32de2a25d06f24ed18fd83c3f8129a63d0a04
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUwFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUub:i33333333sK33333333sq
TLSH
T1C787E146FD8680B0EC7A60304CE7E2374936BE3AC025CA9AF9CA77067F37E61541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 00d736677ceb0a84409fdad04dd82cc69c7a8dc165a6a223b23cc7ec2f7808d8
MD5 c7d7d5bd6fba96e05bb1bab0f4a84a90
SHA1 80bdd891d8b04a26e56ead4118c2af137e4003e8
SHA512 314c387c3b87262f5858e9ee44ca26991a7d67da1622e56e830b5a57b97e6bb7a07cdc6448597efc58bc97d9be91749d909795b0b3ca0d5b3b2da8d09d86dda3
TLSH
T13F112361B0F9D823F53268CF6D15DD8288E8328E6C5C6A15E30D831ABB65C34CD15CF2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1272-79-0x0000000000820000-0x0000000000841000-memory.dmp

Download

memory/3784-80-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/5016-7-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/5016-0-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/5776-24-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/5776-34-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download