86695c75fc59038171fc77f5200854134e23bc5ec6a56e693112756b7810f72d

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_367a2b5b2c70bf03dcee4b114d317df0_elex_stop.exe
Size 4.9MB
Sample260810-da7gkatxdt
SHA256 86695c75fc59038171fc77f5200854134e23bc5ec6a56e693112756b7810f72d
MD5 367a2b5b2c70bf03dcee4b114d317df0
SHA1 659d00f553cb9a633a77baf45fba321f280605ee
SHA512 f2af6b59eed720a3a7dd038341dc978a12ed17d2219087ae5a73869f513cdfdd8b5a08fc76af7e9dadffe02e37c72f4fd50f9b17933ca139971f730660e9a8d1
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCG+E6Dd79WCY+Ej:Jp7Dp7Dp7Dp7Dp7tp7Dp7Dp7Dp7Dp7q
TLSH
T15F368C10B7818035F5B329728ABFE739552CB9714F6986CFE388072E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
1184	svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe
1480	svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACCCACBCCBBBBAABBCABACCBBCABCABABCBAACCABACBCBCACACCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe"	2026-08-10_367a2b5b2c70bf03dcee4b114d317df0_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBACCCBCCCACACCCCACAABBACCBACBCBCBAACCBAAAAACBBCCCAAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCAABBBBACACBAAAAABBCCCCCBCCCBACCCCBBBACCACBBABBBAAAAB.exe"	svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
852	sc.exe
4384	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2080	cmd.exe
3348	cmd.exe
952	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_367a2b5b2c70bf03dcee4b114d317df0_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4256	2026-08-10_367a2b5b2c70bf03dcee4b114d317df0_elex_stop.exe
4256	2026-08-10_367a2b5b2c70bf03dcee4b114d317df0_elex_stop.exe
4256	2026-08-10_367a2b5b2c70bf03dcee4b114d317df0_elex_stop.exe
4256	2026-08-10_367a2b5b2c70bf03dcee4b114d317df0_elex_stop.exe
1184	svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe
1184	svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe
1184	svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe
1184	svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	2026-08-10_367a2b5b2c70bf03dcee4b114d317df0_elex_stop.exe
Token: SeDebugPrivilege	1184	svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 2080	4256	2026-08-10_367a2b5b2c70bf03dcee4b114d317df0_elex_stop.exe	92
PID 2080 wrote to memory of 6044	2080	cmd.exe	94
PID 4256 wrote to memory of 3348	4256	2026-08-10_367a2b5b2c70bf03dcee4b114d317df0_elex_stop.exe	95
PID 3348 wrote to memory of 852	3348	cmd.exe	97
PID 4256 wrote to memory of 952	4256	2026-08-10_367a2b5b2c70bf03dcee4b114d317df0_elex_stop.exe	98
PID 952 wrote to memory of 4384	952	cmd.exe	100
PID 1184 wrote to memory of 1696	1184	svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_367a2b5b2c70bf03dcee4b114d317df0_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_367a2b5b2c70bf03dcee4b114d317df0_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCCBABACBBBCABCCBBAAACABCCBCBCCBCBBCABCACBABBBACCABCBABCBAABCACBABACCABABACBAACBCACBCCCACAABACACBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCCBABACBBBCABCCBBAAACABCCBCBCCBCBBCABCACBABBBACCABCBABCBAABCACBABACCABABACBAACBCACBCCCACAABACACBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABCAABABAABCBBABACABCCAABBBAABBAABBCBCCCBBBAAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe" start= auto displayName= "UserDataSvc_CAABCAABABAABCBBABACABCCAABBBAABBAABBCBCCCBBBAAABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABCAABABAABCBBABACABCCAABBBAABBAABBCBCCCBBBAAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe" start= auto displayName= "UserDataSvc_CAABCAABABAABCBBABACABCCAABBBAABBAABBCBCCCBBBAAABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABCAABABAABCBBABACABCCAABBBAABBAABBCBCCCBBBAAABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABCAABABAABCBBABACABCCAABBBAABBAABBCBCCCBBBAAABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe
1⤵
- Executes dropped EXE
PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7e6a608cf93f44d3196521200cf584481f31e4f9f178d45cb0c22efff17466e8
MD5 5816364acd2cd07b5cf1470ba7a39bf3
SHA1 b55005860302b22c25f105cee607a03dac0770ba
SHA512 b639baf277f33fe14cedac06f9a26566a97589c3f33ef648fa62337ad1ce9cd69aec459f918e633ec9e4fea0162fa9b0a386c467de8397f66c19126662022f55
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ff45e486e7a635a28e155751a1b213ea11ae29f01d11b4694d57199802797228
MD5 2079e6817c2a657e7d86e717e8b09a87
SHA1 d3a3070a5f38f8c0f77deb788490cc72554e506e
SHA512 f1becf00f2df91491b10fe9ef830051f071708c332176972816dcd95fe9dbdd6565b3b3c474bd83952930370a4ce27ab76533289287d7571b9815c7612ba62c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 24dfb4c150376d70cf583bdb74f0a2d9aadb606bcdeef2576e0f102bf3a18bcd
MD5 472ece4c321c2377548e494a3ae931e5
SHA1 3426b56036cedc460b81002074fb1ce87a46d96f
SHA512 08e7d8c29da7c80aa0be022a0b3905c1432cf9945f5191d619f36cf66adbc0f9a81fb06afc15bac1110ebfacde14ee26413f2287d19886e2cffc018b44a4496a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ac5d732c8a0273a991fe8ccc9bbb6facc2c7b0179404601a8c1ea16fb39a4922
MD5 1303ebe20e6a9b829e0670ce0b03ad52
SHA1 3973142db2776ba5bd2a6ab385c58b40f6ea9285
SHA512 136be63625d336cfab3913ea6f0c1463bd78168f40e704e4d57644e74f90039846b0cdb697f9a1e127dc820638d699182eff08cbd07424f69c6b39023f2b0261
MD5 SHA1 SHA512

Submit Download

svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACBCCBBCCABBAAACBACCCCBCACCCCAAAACACCCBBBBACBCCAAC.exe
Size 4.9MB
SHA256 86695c75fc59038171fc77f5200854134e23bc5ec6a56e693112756b7810f72d
MD5 367a2b5b2c70bf03dcee4b114d317df0
SHA1 659d00f553cb9a633a77baf45fba321f280605ee
SHA512 f2af6b59eed720a3a7dd038341dc978a12ed17d2219087ae5a73869f513cdfdd8b5a08fc76af7e9dadffe02e37c72f4fd50f9b17933ca139971f730660e9a8d1
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCG+E6Dd79WCY+Ej:Jp7Dp7Dp7Dp7Dp7tp7Dp7Dp7Dp7Dp7q
TLSH
T15F368C10B7818035F5B329728ABFE739552CB9714F6986CFE388072E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1184-24-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/1184-37-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/4256-0-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/4256-8-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download