2b9fa530d4ec2496659d5ba7e4cce7db75200cccd446ed6828ccca380debe839

Analysis

max time kernel
151s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_b98ca237aa13368ca173334bf89d4327_coinminer_elex_hijackloader_stop.exe
Size 19.8MB
Sample260810-cf68bahk7v
SHA256 2b9fa530d4ec2496659d5ba7e4cce7db75200cccd446ed6828ccca380debe839
MD5 b98ca237aa13368ca173334bf89d4327
SHA1 5b4ebb5836e4f2ee2b6aadd685ae21d7d33eb091
SHA512 ce06a26903c339f4f9b360d415942b00609d21d7359b294bb801bf159c91c3567fa719706246835d3f474f3199df465c0353d7ee24a52bc494e711c75567d4ab
SSDEEP 196608:vBBBBABBBBABBBBABBBBABBBBABBBBABBBBABBBBmnSQ:Rj
TLSH
T165278C10B7818035F5B329728ABFE739552CB9714F6986CFE388072E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c539-26.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2800	svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe
3368	svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe
2608	svchost_AAACABBCAAACAABBAABABCBCBCCBBAACCACBABBABAABBBBABACBAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBABCBCCAAABACCBAAAABBCACAAABCCAAACACCBCBCACAAAAAAACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe"	2026-08-10_b98ca237aa13368ca173334bf89d4327_coinminer_elex_hijackloader_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABCACCAAABCCBCBCAACACBCCABBBBACAABCAACBCACBCCBCCABBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACABBCAAACAABBAABABCBCBCCBBAACCACBABBABAABBBBABACBAAC.exe"	svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5080	sc.exe
5428	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3908	cmd.exe
3416	cmd.exe
1456	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_b98ca237aa13368ca173334bf89d4327_coinminer_elex_hijackloader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACABBCAAACAABBAABABCBCBCCBBAACCACBABBABAABBBBABACBAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2996	2026-08-10_b98ca237aa13368ca173334bf89d4327_coinminer_elex_hijackloader_stop.exe
2996	2026-08-10_b98ca237aa13368ca173334bf89d4327_coinminer_elex_hijackloader_stop.exe
2996	2026-08-10_b98ca237aa13368ca173334bf89d4327_coinminer_elex_hijackloader_stop.exe
2996	2026-08-10_b98ca237aa13368ca173334bf89d4327_coinminer_elex_hijackloader_stop.exe
2800	svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe
2800	svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe
2800	svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe
2800	svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe
2608	svchost_AAACABBCAAACAABBAABABCBCBCCBBAACCACBABBABAABBBBABACBAAC.exe
2608	svchost_AAACABBCAAACAABBAABABCBCBCCBBAACCACBABBABAABBBBABACBAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	2026-08-10_b98ca237aa13368ca173334bf89d4327_coinminer_elex_hijackloader_stop.exe
Token: SeDebugPrivilege	2800	svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe
Token: SeDebugPrivilege	2608	svchost_AAACABBCAAACAABBAABABCBCBCCBBAACCACBABBABAABBBBABACBAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3908	2996	2026-08-10_b98ca237aa13368ca173334bf89d4327_coinminer_elex_hijackloader_stop.exe	93
PID 3908 wrote to memory of 2060	3908	cmd.exe	95
PID 2800 wrote to memory of 2980	2800	svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe	96
PID 2996 wrote to memory of 3416	2996	2026-08-10_b98ca237aa13368ca173334bf89d4327_coinminer_elex_hijackloader_stop.exe	97
PID 3416 wrote to memory of 5080	3416	cmd.exe	99
PID 2996 wrote to memory of 1456	2996	2026-08-10_b98ca237aa13368ca173334bf89d4327_coinminer_elex_hijackloader_stop.exe	100
PID 1456 wrote to memory of 5428	1456	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_b98ca237aa13368ca173334bf89d4327_coinminer_elex_hijackloader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b98ca237aa13368ca173334bf89d4327_coinminer_elex_hijackloader_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACACAACCBBCACAACCACCBABABCBABCCAABABBCCCCBBCCCCBBACCBCCCCCBCBCCBBCBBBABBBABBBBABBABACBAABBBABCCAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACACAACCBBCACAACCACCBABABCBABCCAABABBCCCCBBCCCCBBACCBCCCCCBCBCCBBCBBBABBBABBBBABBABACBAABBBABCCAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBCCCCCCCABAACBACBACAAABAABCBCBCBAAAAACCBACCBBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe" start= auto displayName= "UserDataSvc_CACBCCCCCCCABAACBACBACAAABAABCBCBCBAAAAACCBACCBBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBCCCCCCCABAACBACBACAAABAABCBCBCBAAAAACCBACCBBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe" start= auto displayName= "UserDataSvc_CACBCCCCCCCABAACBACBACAAABAABCBCBCBAAAAACCBACCBBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBCCCCCCCABAACBACBACAAABAABCBCBCBAAAAACCBACCBBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBCCCCCCCABAACBACBACAAABAABCBCBCBAAAAACCBACCBBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5428

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2980

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe
1⤵
- Executes dropped EXE
PID:3368

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABBCAAACAABBAABABCBCBCCBBAACCACBABBABAABBBBABACBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABBCAAACAABBAABABCBCBCCBBAACCACBABBABAABBBBABACBAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 36fd17a136477671ee0568acf9bc8106122509bebee96964b60a7580d4d9df8e
MD5 d4aecf1b4c6d63b275566718cd9fc49f
SHA1 8ac26d7f9796d3f000ac331233003c3ce62bfbfa
SHA512 b9feac709b16a3418750ffce0b039bd17597483c76d2bcd664ed2d06869ebc4c1d4c01f6cb9ba00480cfe1aa21d4b5ac12fc5c7e80983d9af79ff13e2c829cdc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 efc5ef07dd8bd70727fb0aa8f75baf24bd58c97d0a76cf403871cad1bab6dd35
MD5 6b7c8c48f4bfe638f702480db076ad12
SHA1 ea11717a8cec677eebeb6f9b179fb2715619c829
SHA512 8f2a434f0c4293e4cd470c21c82ac9de45bc9aacb1bf87933afd9c17dfb8927293effd60850052ce7c2ec6c935df5b96978edd600de761852dddc7c89e648c0c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4227cc3b42a1c867bb294bc27751e87c7f2f1df9d34909a3aa40b9f055a68f6e
MD5 4264e2e2174746fdeca706f40e0f815e
SHA1 e8773f34b2b053f28e4efb4cb0c67a0e78d60a29
SHA512 8d735fba710df5d067f5d869f03aa02b5bca3c94cf9cac5b9e3ea2e6d4ce06fba59e552e7350509fdf454591c3bc6ce08771c8003bfdaa1937de0fe06ea60202
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 299b211fb60e183d3113f44a24d2dabe8e6a01cf8b9119d6c52d8c5142a66d77
MD5 a557497f57e4859b557e7ef2706c4ea4
SHA1 767dc78c2194b629ba156771f26ecf3f910059a7
SHA512 e760dad1e4dbd4ab6f0fae22e798c794afa5d0a15bb0ed1895389b99d115c9e3e7ab14af59cd966ba37ca4c53a561ed8cb943c5a098b7af3bf2b3af4810712a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 12e516164c0d03b03b502f6c77aec2ecbd610eade8f39fe99f7154724bf6830f
MD5 dc58f25e28d58bad551d0e678c901d76
SHA1 10d0b6e5799678b4a192dbb475f470e257464272
SHA512 bb3101adf252cab0768b04b0a2ab5fcf8c6c60c293673cf80566bcec9c124dc745b9d93fdecd479c3d2bb5e8b62ad1e58c89de4767122e7511aa52c73ca28a8e
MD5 SHA1 SHA512

Submit Download

JoinGrant.exe

Path C:\Users\Admin\Downloads\JoinGrant.exe
Size 768KB
SHA256 9a0d89a43de5b9242215e2ca1cb2cce7b42aadf3ca330b07634a0b0118ddf0c3
MD5 2ffee7695f3c4d1f2b2a583fecb994c5
SHA1 b63959c2c63b2b5c4e5767387f1713a211d5d6e8
SHA512 79550de2dcf2f02be4aa134b0680bb85afe9188f78258b54c6a691b604d1e5bbc6ab0bc12140ad661ef620306121a480155da0598fc9edb3d45463eb9da10b95
SSDEEP 12288:mgUFgEsnojAOa0wIk0BX3RKuemGd70ioGuVWW6oIagUFgEsnojAOa0wIk0BX3RKS:m9+EM03afDd70iTWCa9+EM03afDd70i6
TLSH
T162F49E11BA818036F5B324718EFFD339556CB9314F258ACFE7880A2A5E71AE1E53471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e348e4b66293c50ea4cfd8fdeda9a26d03ae968a200476bead4da1ad8f2243f3
MD5 7354ae03ad02ece5dfae2e4a76d5ed11
SHA1 ec902cb14c2a55da88abe290b8c579655b69b2c2
SHA512 86ccd8b5fbc3d386f109e3abe1a4d35b8b59e0bad261691e10081b877cf7d13dfbde1ac65d11510544e6d4764c787f0631a053ab888ad815212cd20315588cdc
MD5 SHA1 SHA512

Submit Download

svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAAAABCCABBCBCCBCBACCBAACABCAACCABBCBCCABCBBBBAACBB.exe
Size 19.8MB
SHA256 2b9fa530d4ec2496659d5ba7e4cce7db75200cccd446ed6828ccca380debe839
MD5 b98ca237aa13368ca173334bf89d4327
SHA1 5b4ebb5836e4f2ee2b6aadd685ae21d7d33eb091
SHA512 ce06a26903c339f4f9b360d415942b00609d21d7359b294bb801bf159c91c3567fa719706246835d3f474f3199df465c0353d7ee24a52bc494e711c75567d4ab
SSDEEP 196608:vBBBBABBBBABBBBABBBBABBBBABBBBABBBBABBBBmnSQ:Rj
TLSH
T165278C10B7818035F5B329728ABFE739552CB9714F6986CFE388072E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1c330584e4f8d56c6a3f84ccca184e1a8ba54976cf567b28103f127887628edb
MD5 b74f26fb7b6a59a921f052c620d520c2
SHA1 266503c09ae0c93a958989e3b0c82996ce9ab79e
SHA512 0bf40057014a829c8fef599556958e5151bdf23a276a7c822fe3d3037b3294e8f23f085d977ad781b8c2061a4680f37b20c46d820d6b8d53cf66db7918a7874f
TLSH
T147110821D5B9D8A3B833A8CB5619CBB30CE8369B781C6E1022494119EA98C30CD5E4F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2608-95-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/2800-51-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/2800-33-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/2800-72-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/2996-60-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/2996-86-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/2996-0-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/2996-34-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/2996-22-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/2996-11-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/3368-88-0x0000000000010000-0x0000000000031000-memory.dmp

Download