b47eea11f1869b0e8c7694fdebf4d8bbc4265b21f4cfd241c19ea1ba94fdcf52

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_c957d9f3d209a8013f24b2eac360d09d_elex_stop.exe
Size 58.8MB
Sample260808-vs238svybx
SHA256 b47eea11f1869b0e8c7694fdebf4d8bbc4265b21f4cfd241c19ea1ba94fdcf52
MD5 c957d9f3d209a8013f24b2eac360d09d
SHA1 18f20e3a50eb9668e1c62d3b2b5357aca582e18e
SHA512 27bc67f9b29256060f985ebf7c0147e7ddaa158aba928e4c6f8bff4bc834e96506b84d239b294bd25dbac30586d176022c8d22ea76823b40254518d9f978ce3c
SSDEEP 1572864:i3333333T3333333i3333333T33333335:i3333333T3333333i3333333T333333p
TLSH
T1A7D7E146FC8650B0DD7A64704CEBE23B4836BE3BC0258A99F9CA7B067B37E61540F456
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5416	svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe
2572	svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe
968	svchost_CBCBABACCCBAACAACCACCBCAABACBABBCCBBABAAACABAABCACBBBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAACABCBAABCBBABCABACBBBCCACBABCBBACAABACCBAABAAABCAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe"	2026-08-08_c957d9f3d209a8013f24b2eac360d09d_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBACCACCACCCBABAABABCBBACCABBCAACBBBBBCCCAACBBBBCBCBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBABACCCBAACAACCACCBCAABACBABBCCBBABAAACABAABCACBBBAC.exe"	svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1456	sc.exe
1324	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2856	cmd.exe
1688	cmd.exe
2828	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBABACCCBAACAACCACCBCAABACBABBCCBBABAAACABAABCACBBBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_c957d9f3d209a8013f24b2eac360d09d_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4764	2026-08-08_c957d9f3d209a8013f24b2eac360d09d_elex_stop.exe
4764	2026-08-08_c957d9f3d209a8013f24b2eac360d09d_elex_stop.exe
4764	2026-08-08_c957d9f3d209a8013f24b2eac360d09d_elex_stop.exe
4764	2026-08-08_c957d9f3d209a8013f24b2eac360d09d_elex_stop.exe
5416	svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe
5416	svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe
5416	svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe
5416	svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	2026-08-08_c957d9f3d209a8013f24b2eac360d09d_elex_stop.exe
Token: SeDebugPrivilege	5416	svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 2856	4764	2026-08-08_c957d9f3d209a8013f24b2eac360d09d_elex_stop.exe	92
PID 2856 wrote to memory of 2332	2856	cmd.exe	94
PID 5416 wrote to memory of 6044	5416	svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe	95
PID 4764 wrote to memory of 1688	4764	2026-08-08_c957d9f3d209a8013f24b2eac360d09d_elex_stop.exe	97
PID 1688 wrote to memory of 1456	1688	cmd.exe	99
PID 4764 wrote to memory of 2828	4764	2026-08-08_c957d9f3d209a8013f24b2eac360d09d_elex_stop.exe	100
PID 2828 wrote to memory of 1324	2828	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-08_c957d9f3d209a8013f24b2eac360d09d_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_c957d9f3d209a8013f24b2eac360d09d_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABCACCBAAAABACBBCBAAAACAACBABBBCACACCACAAAACCCACABCABCBBCBBCABCCACBCAAAAACABCACCCAACBAABABBBACCBABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABCACCBAAAABACBBCBAAAACAACBABBBCACACCACAAAACCCACABCABCBBCBBCABCCACBCAAAAACABCACCCAACBAABABBBACCBABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCBCBAABCABAACBBBBAACCCCBABBCAACCBBBBABABCABCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe" start= auto displayName= "UserDataSvc_ACBCBCBAABCABAACBBBBAACCCCBABBCAACCBBBBABABCABCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCBCBAABCABAACBBBBAACCCCBABBCAACCBBBBABABCABCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe" start= auto displayName= "UserDataSvc_ACBCBCBAABCABAACBBBBAACCCCBABBCAACCBBBBABABCABCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCBCBAABCABAACBBBBAACCCCBABBCAACCBBBBABABCABCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCBCBAABCABAACBBBBAACCCCBABBCAACCBBBBABABCABCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6044

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBCBCACCCACCCBCCAAABCBACCBCBCABBBAABCBCCCCBBBBAAAABB.exe
1⤵
- Executes dropped EXE
PID:2572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABACCCBAACAACCACCBCAABACBABBCCBBABAAACABAABCACBBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABACCCBAACAACCACCBCAABACBABBCCBBABAAACABAABCACBBBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3d63034e0d0a4a682608acc293645b5d6411786b7e151d844292729a09a55c29
MD5 bf7f805dfbe49f340168e28142939ef2
SHA1 f3cd802188aa35f711e5541824085841023d4187
SHA512 a69430cb27fe6172f6d160910b72c5484b31c5434886495a5cf6c061f5a72c37553684852e777ebc4bd18b11319f6bf98df4e3c35906ad1b1c6b12e77e805fc4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be1f84627327dec2c30a87d8696bb7364dde05f1c615b48ee520711d72b3e69a
MD5 8373810fb66e710005dc70321598b101
SHA1 547ce278bde9bb08e7ac16d2744046ffd295e97e
SHA512 861431ed7a4052ab49d3804f52d9990038d8badd747d981ff92d07a38c3e64ca493f8f57a166332b9dd0b9227c1c9b39a34912f82857df0ccd2657d32ea43f75
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3e4e64ae3573854c5671528ffc19e3a8a8bde9072504ce86f7e1c833fb8892fb
MD5 392bbdb40017fe5fa80b94dbb506aeda
SHA1 bd8c794012b1c05852d0e139c3c5ee5d1c580ed0
SHA512 f67227a3082ede96e83f1c3dee492c70e381e522aad526482246079963d9974c9b0c1ac2a2d070debc37ce9362430a0485ef372db134ed52c0f6185c64e2147c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e84a0273c8a278250863ef25ea4048d64665e0befa2747696f2bb6154fe9833b
MD5 c60e894fea4d5713234ea4bf6d10ba3f
SHA1 ec981596f773d349bb789d3d9154b9c951e81a1e
SHA512 aa791e8b9834c9345b157e835fba78ed994abaa5f1b872cae71821667665f98c1c556f71a92a219470d35a5a3864dabab11a35c2a41ed769018bbe18348ffa45
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5b4edeae505fa7805f7770816621e56102f1935e51e9f235d55a5d5dd25f6585
MD5 b8b4670ee7d84e1433c45a6d01ac2cfa
SHA1 6d786c8e2bcd5402382954c757f15b4be69335a1
SHA512 00766f8839b0a616181e27006091e03b0c698096d7a735c5526f7a9b1e7f3ac99642b47222db3dee239177249ed92921eb3fed4e00664d731f31ea4724313cb8
MD5 SHA1 SHA512

Submit Download

memory/2572-70-0x0000000000930000-0x0000000000951000-memory.dmp

Download

memory/4764-0-0x00000000006E0000-0x0000000000701000-memory.dmp

Download

memory/4764-7-0x00000000006E0000-0x0000000000701000-memory.dmp

Download

memory/5416-24-0x0000000000930000-0x0000000000951000-memory.dmp

Download

memory/5416-34-0x0000000000930000-0x0000000000951000-memory.dmp

Download