d705e7fa72bc54104e3446a91dd41bd85b70ff00693580ccc23c85ea8c9d47f0

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_09edff8f8b5329de74b36748e5989fa0_elex_stop.exe
Size 3.3MB
Sample260810-dk5eystyhy
SHA256 d705e7fa72bc54104e3446a91dd41bd85b70ff00693580ccc23c85ea8c9d47f0
MD5 09edff8f8b5329de74b36748e5989fa0
SHA1 3cdd080623f53e7e899e9bf080bafb2f21630303
SHA512 2c88732ceac63dd42d500e590512c39bb4d95dc09422d96e93ffb2e4b011b9c17d0835c90060d07a86cc2847fdfb2a48e52010fe7981bbd86b6607ac3f81a479
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+E/+EF+Ei+Ed:Zp77
TLSH
T114F51A09FD4344B1D92B51B00DCFE3BF8A60BB25C4128EBAFB4ECB5B6933B615428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
244	svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe
4648	svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe
1164	svchost_BACABCACBACABAABBAAACCBBABCBACBACCABABCCABCABBAACBABCAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCAACCAABCCCCABCBBBACABBCACCAACBABAACBACAAACBBBAAAACBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe"	2026-08-10_09edff8f8b5329de74b36748e5989fa0_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCBCCCBCBCBCBBAABBAABCABABCCAABCCBBBACBCCCCBACCBBBBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACABCACBACABAABBAAACCBBABCBACBACCABABCCABCABBAACBABCAC.exe"	svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4304	sc.exe
916	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1532	cmd.exe
1716	cmd.exe
1356	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_09edff8f8b5329de74b36748e5989fa0_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACABCACBACABAABBAAACCBBABCBACBACCABABCCABCABBAACBABCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4980	2026-08-10_09edff8f8b5329de74b36748e5989fa0_elex_stop.exe
4980	2026-08-10_09edff8f8b5329de74b36748e5989fa0_elex_stop.exe
4980	2026-08-10_09edff8f8b5329de74b36748e5989fa0_elex_stop.exe
4980	2026-08-10_09edff8f8b5329de74b36748e5989fa0_elex_stop.exe
244	svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe
244	svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe
244	svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe
244	svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	2026-08-10_09edff8f8b5329de74b36748e5989fa0_elex_stop.exe
Token: SeDebugPrivilege	244	svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 1532	4980	2026-08-10_09edff8f8b5329de74b36748e5989fa0_elex_stop.exe	92
PID 1532 wrote to memory of 5116	1532	cmd.exe	94
PID 4980 wrote to memory of 1716	4980	2026-08-10_09edff8f8b5329de74b36748e5989fa0_elex_stop.exe	95
PID 1716 wrote to memory of 4304	1716	cmd.exe	97
PID 4980 wrote to memory of 1356	4980	2026-08-10_09edff8f8b5329de74b36748e5989fa0_elex_stop.exe	98
PID 1356 wrote to memory of 916	1356	cmd.exe	100
PID 244 wrote to memory of 4640	244	svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_09edff8f8b5329de74b36748e5989fa0_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_09edff8f8b5329de74b36748e5989fa0_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACCCBBAAACACABACBCABBBABBBCCCCBBBCCCBCBACCCCAABCBBBACCBCBBBACABCCABAAAABBCBCABBCBACBCBBCAABCCAABBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACCCBBAAACACABACBCABBBABBBCCCCBBBCCCBCBACCCCAABCBBBACCBCBBBACABCCABAAAABBCBCABBCBACBCBBCAABCCAABBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCBCBBBBCAAAACAACCBACCBACABBACABABBACBABAACAABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe" start= auto displayName= "UserDataSvc_CCBCBCBBBBCAAAACAACCBACCBACABBACABABBACBABAACAABBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCBCBBBBCAAAACAACCBACCBACABBACABABBACBABAACAABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe" start= auto displayName= "UserDataSvc_CCBCBCBBBBCAAAACAACCBACCBACABBACABABBACBABAACAABBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCBCBBBBCAAAACAACCBACCBACABBACABABBACBABAACAABBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCBCBBBBCAAAACAACCBACCBACABBACABABBACBABAACAABBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:244
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCACBACABAABBAAACCBBABCBACBACCABABCCABCABBAACBABCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCACBACABAABBAAACCBBABCBACBACCABABCCABCABBAACBABCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1dfc39e18dcb174a6e1b702867860330ebca18b479b5092210e8ffa5948a99f0
MD5 a16a250dbc3dabb39423f7fe48f189d1
SHA1 c9c2ae0c3b894926e2ecb9aaee31e833cdde712a
SHA512 efac396d8c66887548ebe471fafef34fa74e53bb9697fc58ea54f0ef98df0e64a8f4c2a269183dd983c60f6beb8ba6ed21f5a6dee1f49f70919c56d80d5607ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 52931307c098b919f13ef4f1e1dc8607b922f02bf59596f60063c6d8d12cab72
MD5 0eb79aa8f6afcdf502655db503b95dff
SHA1 73b75a31dd6e2845d0c7a51355b195ea0f3d2a9c
SHA512 aca8a8a33a2bf78485b7eb54912c9ea1c6552d491f60be409742b61e8f5e9bf1a2abf6bb2720fbd310baa9ef1f210524ecf90c085f5c405f56686f2d5278bda8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 04a811fef2aa85ad62c58a693d741e35453f3439a552797cee9ac66009a7e327
MD5 9477e60e8ea3fe53cf730fa8d0f58567
SHA1 a9171d060a4ab8fc9cb9f1561ff6499990f1c706
SHA512 23de5abf54ad66bafc108830a983838efa765838627922caa39a5fbd4f4db692d0669148680a3d74aef5be4243450cc0907391b9c0035890b806802dd3ee57f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f3e72c5d78ebbf87a80634357e21ae0b02edce306a1b9591b3cdd4ed4319a6ec
MD5 ac8ec2a7692d030f28d39783e1cb1010
SHA1 b38e946e835d5a1795c62400cb52c0465a56ca8b
SHA512 3cd3e154c43a3fd0417cc52d1cab205bb4a52b123481855a4deffd789476dc6235ead61848ee079eb15a80743acbc5791a2eb64ac32b67b7b2566b672d2bdb57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6e82ceed1a07d396ced174e13ad03788f8afdc099638aafef0a3853d1ce9702f
MD5 50b9dd164c872d615727cd6c9a0d0eb7
SHA1 2d850a6d0b079cd950a0e1097d76e2361ae4d417
SHA512 bb311e05e83aec503e2f795221e3d686a211a584094169cb3d1f01a6edba909f9fe24258f448ec57a14d0edaa6e1d3aed45cc0e9988a024c3f709dbfa4dcbab4
MD5 SHA1 SHA512

Submit Download

svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBACCBAABBABBBABABBCBCACABBBCCAABBACCCABAAAAABACBAB.exe
Size 3.3MB
SHA256 d705e7fa72bc54104e3446a91dd41bd85b70ff00693580ccc23c85ea8c9d47f0
MD5 09edff8f8b5329de74b36748e5989fa0
SHA1 3cdd080623f53e7e899e9bf080bafb2f21630303
SHA512 2c88732ceac63dd42d500e590512c39bb4d95dc09422d96e93ffb2e4b011b9c17d0835c90060d07a86cc2847fdfb2a48e52010fe7981bbd86b6607ac3f81a479
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+E/+EF+Ei+Ed:Zp77
TLSH
T114F51A09FD4344B1D92B51B00DCFE3BF8A60BB25C4128EBAFB4ECB5B6933B615428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-22-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/244-35-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/1164-72-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/4648-66-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/4980-6-0x0000000000640000-0x0000000000661000-memory.dmp

Download