449aa2aecd732a687d68d3cd3b7880320e134841d05080affa36ba65ffbf9dc4

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_aa229c9b42bd76c5b59cc8bfdaf82dde_coinminer_elex_hijackloader_stop_vidar.exe
Size 19.0MB
Sample260810-ckna1ade69
SHA256 449aa2aecd732a687d68d3cd3b7880320e134841d05080affa36ba65ffbf9dc4
MD5 aa229c9b42bd76c5b59cc8bfdaf82dde
SHA1 d0bad5d995668b8b4cccf46f8cb1e13c66a53ca2
SHA512 6648fc0493c31f7f63e6cad6b93b92a5e90f6f9c447dfd259f5641a479605ded6545c1d58a2a7b59e067fd7c36f0497ee4fea759fe5c6715d22804e1551cc0fa
SSDEEP 196608:vBBBBo5QBBBBo5QBBBBo5QBBBBo5QBBBBo5QBBBBo5QBBBBo5WnSh:A5T5T5T5T5T5T5Wi
TLSH
T13D177B10B7D18135F5B329728ABFD3795939B9214F2886CFE388162E5D31AE0E934727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c508-27.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4560	svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe
1236	svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe
1244	svchost_BBCAAAACBACBCABAABBBBBAACCCAACABBCABCBAACBBBABCBAABCACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCBCCAAAABACCCCACBACCCAABACBBBCCACBBABACCBCCAABBCCABCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe"	2026-08-10_aa229c9b42bd76c5b59cc8bfdaf82dde_coinminer_elex_hijackloader_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCACCABAABCABBBABACCBABCAABBACAACABCACCACACCAABCBACAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCAAAACBACBCABAABBBBBAACCCAACABBCABCBAACBBBABCBAABCACB.exe"	svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4164	sc.exe
1100	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4992	cmd.exe
5192	cmd.exe
5108	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_aa229c9b42bd76c5b59cc8bfdaf82dde_coinminer_elex_hijackloader_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3236	2026-08-10_aa229c9b42bd76c5b59cc8bfdaf82dde_coinminer_elex_hijackloader_stop_vidar.exe
3236	2026-08-10_aa229c9b42bd76c5b59cc8bfdaf82dde_coinminer_elex_hijackloader_stop_vidar.exe
3236	2026-08-10_aa229c9b42bd76c5b59cc8bfdaf82dde_coinminer_elex_hijackloader_stop_vidar.exe
3236	2026-08-10_aa229c9b42bd76c5b59cc8bfdaf82dde_coinminer_elex_hijackloader_stop_vidar.exe
4560	svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe
4560	svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe
4560	svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe
4560	svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3236	2026-08-10_aa229c9b42bd76c5b59cc8bfdaf82dde_coinminer_elex_hijackloader_stop_vidar.exe
Token: SeDebugPrivilege	4560	svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 5192	3236	2026-08-10_aa229c9b42bd76c5b59cc8bfdaf82dde_coinminer_elex_hijackloader_stop_vidar.exe	96
PID 5192 wrote to memory of 6040	5192	cmd.exe	98
PID 4560 wrote to memory of 3800	4560	svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe	101
PID 3236 wrote to memory of 5108	3236	2026-08-10_aa229c9b42bd76c5b59cc8bfdaf82dde_coinminer_elex_hijackloader_stop_vidar.exe	102
PID 5108 wrote to memory of 4164	5108	cmd.exe	104
PID 3236 wrote to memory of 4992	3236	2026-08-10_aa229c9b42bd76c5b59cc8bfdaf82dde_coinminer_elex_hijackloader_stop_vidar.exe	105
PID 4992 wrote to memory of 1100	4992	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_aa229c9b42bd76c5b59cc8bfdaf82dde_coinminer_elex_hijackloader_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_aa229c9b42bd76c5b59cc8bfdaf82dde_coinminer_elex_hijackloader_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCBCABAABCCBACCABACBCCBABBCACACCCBBCBBCBAAACBBCBAACCCACABACACCBBCBCCCBBCCAACAABBBCACABCCBAACCCBCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCBCABAABCCBACCABACBCCBABBCACACCCBBCBBCBAAACBBCBAACCCACABACACCBBCBCCCBBCCAACAABBBCACABCCBAACCCBCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAACCCABACCCBCAAAACAABCCCCACCAACCBAABAAACACABACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe" start= auto displayName= "UserDataSvc_CAAACCCABACCCBCAAAACAABCCCCACCAACCBAABAAACACABACBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAACCCABACCCBCAAAACAABCCCCACCAACCBAABAAACACABACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe" start= auto displayName= "UserDataSvc_CAAACCCABACCCBCAAAACAABCCCCACCAACCBAABAAACACABACBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAACCCABACCCBCAAAACAABCCCCACCAACCBAABAAACACABACBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAACCCABACCCBCAAAACAABCCCCACCAACCBAABAAACACABACBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3800

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe
1⤵
- Executes dropped EXE
PID:1236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAACBACBCABAABBBBBAACCCAACABBCABCBAACBBBABCBAABCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAACBACBCABAABBBBBAACCCAACABBCABCBAACBBBABCBAABCACB.exe
1⤵
- Executes dropped EXE
PID:1244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallPublish.exe

Path C:\Users\Admin\Desktop\InstallPublish.exe
Size 576KB
SHA256 82c5991b8a63eaa80f220608dc5fad8f9e73adb08cfbbeb30d17a973225b6d3b
MD5 5979dde8068a3b28a3a44482ac9b0293
SHA1 3e54d40324707d733f9db931548bdba4c33f8a82
SHA512 8ded8a2cdac53235cd28bb0a354af95c7d292ae99d48b5a8d37e9af4ba8ce123e854ad4209d3c7f45fadbf2b540cab0585041e3792920bb0a0a49f5baf1b07b2
SSDEEP 12288:mgUFgEsnojAOa0wIk0BX3RKuemGd70ioGuVWW6oIagUFgEsnojAl:m9+EM03afDd70iTWCa9+EM0e
TLSH
T189C47C11FA818035F5B325724AFFE3394528B9218F298ACFE78C472E5D71AE1A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 57ae45a11d8b4f6652baf2e71485196c612bf1853c37ff24dee56a6a8bbb09f5
MD5 5e6efbdd425b680ff58d55dfbb9a43c7
SHA1 feafb7f3c26cb9d7c6005319dcda2ef5050942f3
SHA512 5fa0c811db8f5ae214b47974297a69c86d96d203f7570d8854a91aac89b09c97b4555b3490fb74b7a2e5fd42de632d6131321ec773e3b910cbda3d40eac8c327
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 117e01dee4a3047b1763b89540dab2e2165351c0e9c7c87b1fa6d7182e6a180e
MD5 9a1e0b8138e89c81364094d207f5bb94
SHA1 058f9a352e74834b7d1708f0acdbaf1e82a0bf7b
SHA512 78fab57c7f8bdba8876734a6abee9606159f4b5ca27356136ef41bfdbcb4cca025eceb5e6592f6d7e8ae968758cb151da00065d112498614da207495b63e8771
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 23b4af7dc690022a97df0542bc81430bfed9f55c0c4a31eb4596b2c9d99d2683
MD5 75bee90e14b96806fdc340703710f812
SHA1 94dfec0015dec4fd7cc43dd96c8f9914728ad1fe
SHA512 3e23e1cb43f6c922e7073c414240957595a4475df58633cfc9ac38a1f44c1aa31a6a890390eef46f7895e5bad5fa023eaedfb488133356f3c5e9eac63ebbf12f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3fbfe180cfacaf6fb4eaa97891a90a644e3798ac5a3c0bb841f2889bd5dbd3d2
MD5 8d3ab41182f432039a5e4bdbdc50247b
SHA1 b7ed683f66d1b3dca45814b005908ac46a0deceb
SHA512 5570435773460c3544fefc16fe969cc5f961f0bbf53ea62b3d5e82d3818d113b2680d8bd7c3e2eff54096c95b65dd0e3acb3881dc2145352b052bd7550e1d45f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 30658265fb3033fc6dadfc317d06eea91944bcca352e41d3446cc3cf4c6c8fc2
MD5 762c019d40e773ce3679bc32d8879c07
SHA1 8cd5ccc2e1b6c06a3309080ce5530df915307b36
SHA512 650a0c878a99254d729902e99e6c9ebda6023463f234a80491510784b2300239a50666701ef71ed865b1f7d77a7fd42f5aaef75e828e7360ffe4d20f6857576b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c174caf20a113a03fccd658273780a2c1ef2cbc8d5d1f411ec7f275c4ba29702
MD5 2e929a62e320c020f6ec611ffce7d6e9
SHA1 504e8f67999e01d5121b5f24744af82810bd55c1
SHA512 f14149375f9b67388ec534c35a4ae3df12ec5f2d63cfde02e5c613d5706fa77bd04e96c05e359d01ec5ac886d84544150df37518a374b4859448743247ae8917
MD5 SHA1 SHA512

Submit Download

svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBAACBAACAABBCBACBABAAABBCABACCBAABCBBCBACCAABACCACC.exe
Size 19.0MB
SHA256 449aa2aecd732a687d68d3cd3b7880320e134841d05080affa36ba65ffbf9dc4
MD5 aa229c9b42bd76c5b59cc8bfdaf82dde
SHA1 d0bad5d995668b8b4cccf46f8cb1e13c66a53ca2
SHA512 6648fc0493c31f7f63e6cad6b93b92a5e90f6f9c447dfd259f5641a479605ded6545c1d58a2a7b59e067fd7c36f0497ee4fea759fe5c6715d22804e1551cc0fa
SSDEEP 196608:vBBBBo5QBBBBo5QBBBBo5QBBBBo5QBBBBo5QBBBBo5QBBBBo5WnSh:A5T5T5T5T5T5T5Wi
TLSH
T13D177B10B7D18135F5B329728ABFD3795939B9214F2886CFE388162E5D31AE0E934727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BBCAAAACBACBCABAABBBBBAACCCAACABBCABCBAACBBBABCBAABCACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAACBACBCABAABBBBBAACCCAACABBCABCBAACBBBABCBAABCACB.exe
Size 5.0MB
SHA256 fdf96dae96a4b76e2384842b7f5a0be2cc3c1e696b998abbfa23e48be8ab2d23
MD5 5cc7bb02620c9d6451e665273e949d0a
SHA1 0f991acabad23afeee7a2fd16f1e6bd204432589
SHA512 e58f41bc2857421ea20200fe510127758bd8b3df8d0e00a99a88d77424a9df9f5c42d89abefa7748dc031a962c8395e4d8a8d805d8464326bad9fd0cae1a6d25
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7o5Sp7Dp7Dp7Dp7Dp7:vBBBBo5QBBBB
TLSH
T11A366B10B7D18035F5B329728ABFD339592CB9214F2986CFE388162E5D71AE1E93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3236-35-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/3236-61-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/3236-0-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/3236-23-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/3236-12-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/4560-47-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/4560-52-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/4560-34-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/4560-73-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download