82141b0aa2e73da92cea213eb37f3812345f9015021b1331e55d33d443fc01d4

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_f50da7b182f733a58389eed7f04ab4f2_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
Size 35.1MB
Sample260808-cvjessybng
SHA256 82141b0aa2e73da92cea213eb37f3812345f9015021b1331e55d33d443fc01d4
MD5 f50da7b182f733a58389eed7f04ab4f2
SHA1 9aafcee76552b510da7ac2d6cf952187302fa613
SHA512 d5762693227fba25659773e65385e44bfa9bbb57e30127ddce3706b4c62ec4d8ef513ff5b6aba446a1504cc1e18441af05c390d8408b8723c3de094d68b9b46a
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUwFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUe:i33333333sK33333333s6
TLSH
T1A987E147FD8A80B0EC7A20304CE7E2374936BE3AC425CA9AB9CA77057F37E61541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c58b-26.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3492	svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe
5748	svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe
4076	svchost_ABCBAABCCBAACCBBACBABCBBACCBCCCABBABAACBCBAABCBBAACBCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAACACACBCCCBCCAACCCAACBCAABCCABCABACABABCBCACACACCBBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe"	2026-08-08_f50da7b182f733a58389eed7f04ab4f2_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCABABBCBCACBABACCCACABABBCABAAACBBBCBBAACAABCCBACABCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBAABCCBAACCBBACBABCBBACCBCCCABBABAACBCBAABCBBAACBCBB.exe"	svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3436	sc.exe
6004	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4684	cmd.exe
1932	cmd.exe
1408	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBAABCCBAACCBBACBABCBBACCBCCCABBABAACBCBAABCBBAACBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_f50da7b182f733a58389eed7f04ab4f2_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4116	2026-08-08_f50da7b182f733a58389eed7f04ab4f2_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
4116	2026-08-08_f50da7b182f733a58389eed7f04ab4f2_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
4116	2026-08-08_f50da7b182f733a58389eed7f04ab4f2_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
4116	2026-08-08_f50da7b182f733a58389eed7f04ab4f2_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
3492	svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe
3492	svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe
3492	svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe
3492	svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	2026-08-08_f50da7b182f733a58389eed7f04ab4f2_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
Token: SeDebugPrivilege	3492	svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4684	4116	2026-08-08_f50da7b182f733a58389eed7f04ab4f2_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe	96
PID 4684 wrote to memory of 4744	4684	cmd.exe	98
PID 3492 wrote to memory of 2592	3492	svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe	101
PID 4116 wrote to memory of 1932	4116	2026-08-08_f50da7b182f733a58389eed7f04ab4f2_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe	102
PID 1932 wrote to memory of 3436	1932	cmd.exe	104
PID 4116 wrote to memory of 1408	4116	2026-08-08_f50da7b182f733a58389eed7f04ab4f2_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe	105
PID 1408 wrote to memory of 6004	1408	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-08_f50da7b182f733a58389eed7f04ab4f2_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f50da7b182f733a58389eed7f04ab4f2_coinminer_elex_glassworm_hawkeye_hijackloader_redline-st.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCAAABCCABCCACBCACBBBBBCBCBBCBCBACCCACCCAACBACCACACBBCCAABAACBCBCAACBCCCBAACAAABBACCCAACACACAACCCCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCAAABCCABCCACBCACBBBBBCBCBBCBCBACCCACCCAACBACCACACBBCCAABAACBCBCAACBCCCBAACAAABBACCCAACACACAACCCCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBABBBBBACAACABBCBBAAACBBBABACCBBBAACCBBCBCABBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe" start= auto displayName= "UserDataSvc_CCBBABBBBBACAACABBCBBAAACBBBABACCBBBAACCBBCBCABBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBABBBBBACAACABBCBBAAACBBBABACCBBBAACCBBCBCABBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe" start= auto displayName= "UserDataSvc_CCBBABBBBBACAACABBCBBAAACBBBABACCBBBAACCBBCBCABBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBABBBBBACAACABBCBBAAACBBBABACCBBBAACCBBCBCABBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBABBBBBACAACABBCBBAAACBBBABACCBBBAACCBBCBCABBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe
1⤵
- Executes dropped EXE
PID:5748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAABCCBAACCBBACBABCBBACCBCCCABBABAACBCBAABCBBAACBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAABCCBAACCBBACBABCBBACCBCCCABBABAACBCBAABCBBAACBCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ac24d40caa3b93b51bbe87a4c10be14d1f143d8f3a323457efbcdcc0c17c992d
MD5 a8e725e92a34927120e00efdf245ac90
SHA1 da9189498638a7f9de80434f4b237133fc90b47c
SHA512 4fbccb5bbe32fadc45fe9fb34aaef7d49349c84e56563957c819d81c5a3fbfb49a1947e498a8a14c32ab0ed219e31adfad616d8f9d685256f6fc2c2c5e4d96b5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b14b5ea6abeddd38245ce13c865501c4e4e5bb39e6c433bd72c1b057b93f9d26
MD5 1ff0c13533ad1aceb57b758c69c86eb8
SHA1 64e449f0e6fe9b3274efb85e2c8d22f0f5851437
SHA512 6fc8bd19c1de30bbedafca580c6f526cca6f8806948f4b531ee91c37659e452e7e847db8550a34b5dc7bfed9808fec7194a1df4970412e7229483bbedc9f199d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bbfc169c766a9662cd1afce34257b79a893fe388c106eda1c2e1258ec85eedd7
MD5 3b0b66ad1ba881e8e88240b60673b841
SHA1 910e443006bc137543f03eb9df0c72a6110982d0
SHA512 653cabd620b337d067afa8806687cb8ad09ea34ecd34d79c93f1becdf9f134aeee9e13f4146d288dd77cf2ecda0e8a20b60d28823b30939ec5e53f485a0f5f19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4239fb066f2ceffa037fb3804ea1fbfca003f24137edc6964c0ac2ffb3ca9483
MD5 0422ff287d15630b82f1f1888a83dfd7
SHA1 e4f28a99b7825f87e41166a9c17054b1c0a902e5
SHA512 44ddf21704efeb2cb9406fe83b89f7283576e363a67ed37434f70cee7ade1bc5359a4a622ddf7e363d2f11f7a02fd6f59736de9b8fef55443de807bb54e7aee5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3182e865f4bb3ca22a0ce9915a4f4059a8b6799220202bbc02cb00fa5745dd93
MD5 ab7d06832695a0e5c34e484aeba841fe
SHA1 f9412250b85dbc77150265f1d4595b2226fb4670
SHA512 38b2c77e618ae16f2487aad05e6806c9878ab6a0b48bb3537ddeb588274637db448b8734206258997129808ca1997784d8931583732c9ff8c4c73d5446f5296a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 79d281641d88b8a3792e40cab6856e9cb9aba0fedf53c8706e9d9c87320c84d6
MD5 0500ebf1324b864371815045a2fc9350
SHA1 16743d5362fc14fa4fdd44fa79abacaf1723c6c3
SHA512 2e59fa924b73f2af8730f221c194611cde97a2666e5b0c4bb3df02824a241b99f53ebd77042d4906a98c5ee283ba78b69aecf294554e8fc23e4cb8ca6f4c696d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ea889c5d831bd93e5e6463fd36d8a33accb23f83475149f151f334c950ffbef1
MD5 7439fc750b4d227801b8611ac69cdc9e
SHA1 c3f7fd397f029d15c0c0f821f9a658f52e163dd5
SHA512 67a4a0cd9e49ae2771bf0f06d17b9423bdb9fbcc6fcc2f88e013f67398b563173ef368eadc1e96b3e4836f46b4ee929e44613e86dfe78bdd4d12d6fab8a2fc5a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3d255ed8d44ea7b2693722c575d7f7039d7bdf6292cd0c8dea68be07e46ca996
MD5 e74379cc5fe13f1a43e8de181b24271d
SHA1 2c2d8f0ccff5c5acdaeedec76587cb16e5345cf6
SHA512 4cf09fe1ec769712a5bb6d5e1fa5b3e90f61c4d329cad3ea19f6ab704e8db2cb172c7f2551cc6cd5e57c3f3e9702678b4c1a030a497a5b5238d03067fc29d239
MD5 SHA1 SHA512

Submit Download

svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBCCCBCAACBCBACCCACBCACACCABABAABACAAAACBACACCCACC.exe
Size 35.1MB
SHA256 82141b0aa2e73da92cea213eb37f3812345f9015021b1331e55d33d443fc01d4
MD5 f50da7b182f733a58389eed7f04ab4f2
SHA1 9aafcee76552b510da7ac2d6cf952187302fa613
SHA512 d5762693227fba25659773e65385e44bfa9bbb57e30127ddce3706b4c62ec4d8ef513ff5b6aba446a1504cc1e18441af05c390d8408b8723c3de094d68b9b46a
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUwFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUe:i33333333sK33333333s6
TLSH
T1A987E147FD8A80B0EC7A20304CE7E2374936BE3AC425CA9AB9CA77057F37E61541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3492-72-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/3492-33-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/3492-51-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/3492-40-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/4076-92-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/4116-60-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/4116-22-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/4116-0-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/4116-86-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/4116-11-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/4116-34-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/5748-88-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download