efd0c15ed73f3e615e086e204fd3669c534d8321473f32efd998d1b17adbfcd4

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_d3e8466699cef2af3eafdbf0139e8fc9_elex_stop.exe
Size 10.9MB
Sample260810-ejgg6svvf1
SHA256 efd0c15ed73f3e615e086e204fd3669c534d8321473f32efd998d1b17adbfcd4
MD5 d3e8466699cef2af3eafdbf0139e8fc9
SHA1 de6c3ab378765120b2853ea4ea7a25246200a384
SHA512 191488142ecd0493c78a2c729362ba5df73f6422188a4faeda80554a75e3094d2a03370782fc99439fef4cf36c70771a6170fac3cb1e80f8c9ce955014f144fa
SSDEEP 98304:kFPdLbFPdLbFPdLGFPdLbFPdLbFPdLjp7U:kFlfFlfFlyFlfFlfFltU
TLSH
T19DB6E146FD8640B0ED7A24704CEBE23B4436BF3AC0158A9AF9CA7B067B37E61541F456
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c556-20.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
296	svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe
5072	svchost_BCACCABCCBCABACBCBAACBAAACBCBCCABABCABBCAACACBBBACCBACB.exe
1996	svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCCABACAACABBBAACCCABBCACBBAAACBABBCABBACACCACAAACBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe"	2026-08-10_d3e8466699cef2af3eafdbf0139e8fc9_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACCBACCAABABCCABABCBABABCCBCBCAACCCAACCABACBCACCABAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACCABCCBCABACBCBAACBAAACBCBCCABABCABBCAACACBBBACCBACB.exe"	svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3956	sc.exe
4384	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5592	cmd.exe
4996	cmd.exe
4180	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_d3e8466699cef2af3eafdbf0139e8fc9_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACCABCCBCABACBCBAACBAAACBCBCCABABCABBCAACACBBBACCBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1000	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6020	2026-08-10_d3e8466699cef2af3eafdbf0139e8fc9_elex_stop.exe
6020	2026-08-10_d3e8466699cef2af3eafdbf0139e8fc9_elex_stop.exe
6020	2026-08-10_d3e8466699cef2af3eafdbf0139e8fc9_elex_stop.exe
6020	2026-08-10_d3e8466699cef2af3eafdbf0139e8fc9_elex_stop.exe
296	svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe
296	svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe
296	svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe
296	svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe
5072	svchost_BCACCABCCBCABACBCBAACBAAACBCBCCABABCABBCAACACBBBACCBACB.exe
5072	svchost_BCACCABCCBCABACBCBAACBAAACBCBCCABABCABBCAACACBBBACCBACB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6020	2026-08-10_d3e8466699cef2af3eafdbf0139e8fc9_elex_stop.exe
Token: SeDebugPrivilege	296	svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe
Token: SeDebugPrivilege	5072	svchost_BCACCABCCBCABACBCBAACBAAACBCBCCABABCABBCAACACBBBACCBACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 5592	6020	2026-08-10_d3e8466699cef2af3eafdbf0139e8fc9_elex_stop.exe	91
PID 5592 wrote to memory of 1000	5592	cmd.exe	93
PID 296 wrote to memory of 6104	296	svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe	94
PID 6020 wrote to memory of 4996	6020	2026-08-10_d3e8466699cef2af3eafdbf0139e8fc9_elex_stop.exe	97
PID 4996 wrote to memory of 4384	4996	cmd.exe	99
PID 6020 wrote to memory of 4180	6020	2026-08-10_d3e8466699cef2af3eafdbf0139e8fc9_elex_stop.exe	100
PID 4180 wrote to memory of 3956	4180	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_d3e8466699cef2af3eafdbf0139e8fc9_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d3e8466699cef2af3eafdbf0139e8fc9_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBAACAACAABABCBCCBACCCBCACACAABAAABCBAACABCCBACBAAACCCACAACCCBCBACBABBBBCBBBACCBCACBACCBCCCCAACAACABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBAACAACAABABCBCCBACCCBCACACAABAAABCBAACABCCBACBAAACCCACAACCCBCBACBABBBBCBBBACCBCACBACCBCCCCAACAACABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCCAABACCABCCBCBCCCBCACCBCCBCBAACABBCBACACABBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe" start= auto displayName= "UserDataSvc_BBCCCAABACCABCCBCBCCCBCACCBCCBCBAACABBCBACACABBBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCCAABACCABCCBCBCCCBCACCBCCBCBAACABBCBACACABBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe" start= auto displayName= "UserDataSvc_BBCCCAABACCABCCBCBCCCBCACCBCCBCBAACABBCBACACABBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCCAABACCABCCBCBCCCBCACCBCCBCBAACABBCBACACABBBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCCAABACCABCCBCBCCCBCACCBCCBCBAACABBCBACACABBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:296
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCABCCBCABACBCBAACBAAACBCBCCABABCABBCAACACBBBACCBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCABCCBCABACBCBAACBAAACBCBCCABABCABBCAACACBBBACCBACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe
1⤵
- Executes dropped EXE
PID:1996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c19af8223290906ec15f0aa7ef95dc1675e79e8858af72ab94f488de9fb9ef8f
MD5 621aaa02e28da29fa846fdc2bc7188c1
SHA1 6a9e2f5eab653992e69d4d375412900b305dcd03
SHA512 1936f1c9013dc24714c0e857a57b4029338f9c0db7f0ae6f6aa0d0a40351b370880306d3b04000abdaff5d17f4f833cbad52d4ecbe6917887e66ff862f6e1010
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 29c885c4e4761ef5e243205fe344a26fff6a953ea2cc880fc1a7b1db1bd5b7c1
MD5 0eab96244872b5390938f537378ccf29
SHA1 b1dcb4fa133423b12f63445bb49183106a116240
SHA512 2ded484ec6a3d163e4804ce0695f096a8d619b050c6f3bf68e96419a7e272c45a4588291c633720583d1426da5ff3297b09b6844966be66657848b7fac0f177c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 027244044fc5407f95365745beb02aefec9fe0bc77587e1e7b3ae3b4eadadc8e
MD5 58be8a2680d6f07cac24c28d0b803279
SHA1 be0d45bbbdcee1cb977fb213dfa97eaa980535fe
SHA512 07933bbbe383ae6881956038bb09ac8afe3b1cb50ce21363d5cf2c3c7359e40fd0004f24efd27f23f706383a7901f1be1591bc4511b7d24799fa4aafc6bb7efc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e9acd846511f74700db0011aa1526d5d20fcb4abde50163b3a5d877691e7c9b3
MD5 ca474ddaac4c387bc866f976dc99ca5e
SHA1 51edff2123ced654c256fd7b405a14b112d048f4
SHA512 59585d378dcc3e9497efa73d7a97ef5fa634eae0d4c707d718e3011740fdb3a585b194d9f5ff1206d8d9bc0a0cb136ab6063cdadbfdfed5f500aa9c4252baf23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2fe99117f5687c7be573ee3113fb876fd531997b99a4b8e532044c9b129d2111
MD5 86429b44300f88a597db94e8d012b1a0
SHA1 03a2bef4e440e3e9bba28c09a5c1d6449467e7d8
SHA512 c37c9c26579f3f19f6b6b13925ac331452db23d592f01c81aaabd8a7104b8e8d47786bbe06ff5970148d07f482e3dd5b2ff2ee47052e7e5967ef9e3df8ac87e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e75e71b620d550c4026fc28a53cce324331d0bc83b7c7d820077d59bb4ddcb30
MD5 841617aa31f8c025d52592e3d83f2d32
SHA1 e471e44297659d0172ed62964b1c8be14f3448e0
SHA512 305e7f2b41dc3791f147998ecccb5a0e90dd72cbcd2bbd27d7aaf79b1a27d7e9cc66922add4755a83e9d48c2a97288d30a382f7a68398bd87e9ec11bbf127191
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4ab1bfbe8570d8f5d5e5556f5e9d2c7761b272667dd3125867448413223fca37
MD5 ee8a4273b5a0c373a6750c1eaec6ddec
SHA1 c6a7aa0f6ed64a0480f3e656b447478fba7fd2b4
SHA512 d1d6bcd112b971b87f41c4f04745792fd61a779c8a7dae8f72c036c293f38b64c411fb27a0c72ce32226ff25d738f8d71c59e7f2382fa240151df337141c3133
MD5 SHA1 SHA512

Submit Download

svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACCBCCABBBBACCBBBBCCACCABABACACAABCCCABCBCABCAACCAC.exe
Size 10.9MB
SHA256 efd0c15ed73f3e615e086e204fd3669c534d8321473f32efd998d1b17adbfcd4
MD5 d3e8466699cef2af3eafdbf0139e8fc9
SHA1 de6c3ab378765120b2853ea4ea7a25246200a384
SHA512 191488142ecd0493c78a2c729362ba5df73f6422188a4faeda80554a75e3094d2a03370782fc99439fef4cf36c70771a6170fac3cb1e80f8c9ce955014f144fa
SSDEEP 98304:kFPdLbFPdLbFPdLGFPdLbFPdLbFPdLjp7U:kFlfFlfFlyFlfFlfFltU
TLSH
T19DB6E146FD8640B0ED7A24704CEBE23B4436BF3AC0158A9AF9CA7B067B37E61541F456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a353c2fceaaf7ba89aed699eb50a97bf685ee57ddfba506a645713d3f44b6d29
MD5 8e993ed4b7e376cf14cf2260ecb9918a
SHA1 1b58a0a466b6cdbd28bc91167bf7a58452935889
SHA512 ac35a3bf5e5cb6387d3da02c6f822ca41b5eaa3bd66824c506f2ba385158ff3ea90632a8bc5b643c7cdcedb5d37866937ff9990ee2457f71b3720732c2a1dd2c
TLSH
T134112B9298E9C8A3FC2229CB552EEB6308B4779FAC5C6B24130C4119BB59C33CD554F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/296-34-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/5072-64-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/5072-83-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/6020-0-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/6020-8-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download