eef9f110c8ad1332306564fb3e5cd6c228a6800683dfe71f19bf40097348c4ab

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_e575eb950a93c8bfb7bf7a40e05f657e_elex_stop.exe
Size 10.8MB
Sample260814-devcsss1ev
SHA256 eef9f110c8ad1332306564fb3e5cd6c228a6800683dfe71f19bf40097348c4ab
MD5 e575eb950a93c8bfb7bf7a40e05f657e
SHA1 20f013797f626e517bd1b113f3afa5f3088f7bd1
SHA512 9cee905656a3991267c15c0d33a0e40db56d4d8f95eeb96c1508824ee9d1b9d5b8beaa628635b00a32ad44e7f56362c17464352b1ca3854594e810bacf791e99
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+ET+Ee+ES+EX:Fp7z
TLSH
T134B62909F94340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4ECB5B6523BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4284	svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe
1676	svchost_BCCAACBAABAABBCCCABAACABBABCACBBCBCBBBBBAABBBABCBBBAAAA.exe
764	svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BABCABBBBABBCCACACCABCCACCBABBCBACCBBAAAACCBACCBBBCBCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCAACBAABAABBCCCABAACABBABCACBBCBCBBBBBAABBBABCBBBAAAA.exe"	svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBCCBABCABBCACBCBCBBCAAAAAACAABBCBCBCBAABBBABCBAABBAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe"	2026-08-14_e575eb950a93c8bfb7bf7a40e05f657e_elex_stop.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
468	sc.exe
2440	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4468	cmd.exe
1544	cmd.exe
1436	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCAACBAABAABBCCCABAACABBABCACBBCBCBBBBBAABBBABCBBBAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_e575eb950a93c8bfb7bf7a40e05f657e_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4668	2026-08-14_e575eb950a93c8bfb7bf7a40e05f657e_elex_stop.exe
4668	2026-08-14_e575eb950a93c8bfb7bf7a40e05f657e_elex_stop.exe
4668	2026-08-14_e575eb950a93c8bfb7bf7a40e05f657e_elex_stop.exe
4668	2026-08-14_e575eb950a93c8bfb7bf7a40e05f657e_elex_stop.exe
4284	svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe
4284	svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe
4284	svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe
4284	svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe
1676	svchost_BCCAACBAABAABBCCCABAACABBABCACBBCBCBBBBBAABBBABCBBBAAAA.exe
1676	svchost_BCCAACBAABAABBCCCABAACABBABCACBBCBCBBBBBAABBBABCBBBAAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4668	2026-08-14_e575eb950a93c8bfb7bf7a40e05f657e_elex_stop.exe
Token: SeDebugPrivilege	4284	svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe
Token: SeDebugPrivilege	1676	svchost_BCCAACBAABAABBCCCABAACABBABCACBBCBCBBBBBAABBBABCBBBAAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4708	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 1436	4668	2026-08-14_e575eb950a93c8bfb7bf7a40e05f657e_elex_stop.exe	96
PID 1436 wrote to memory of 3396	1436	cmd.exe	98
PID 4284 wrote to memory of 3520	4284	svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe	99
PID 3520 wrote to memory of 672	3520	notepad.exe	100
PID 4668 wrote to memory of 4468	4668	2026-08-14_e575eb950a93c8bfb7bf7a40e05f657e_elex_stop.exe	104
PID 4468 wrote to memory of 468	4468	cmd.exe	106
PID 4668 wrote to memory of 1544	4668	2026-08-14_e575eb950a93c8bfb7bf7a40e05f657e_elex_stop.exe	107
PID 1544 wrote to memory of 2440	1544	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-14_e575eb950a93c8bfb7bf7a40e05f657e_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e575eb950a93c8bfb7bf7a40e05f657e_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACBBABCCACCBACCBACCBCCBACCBAAACCAACACBACACCCBBACBCCBAACCBACBBCBAAAACBCBAABABAAAABABABCBBBBAACCBABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACBBABCCACCBACCBACCBCCBACCBAAACCAACACBACACCCBBACBCCBAACCBACBBCBAAAACBCBAABABAAAABABABCBBBBAACCBABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBBAAABBABCBABBCCBACCBCCBCABABBCBABACBAABBBACAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe" start= auto displayName= "UserDataSvc_ACCBBAAABBABCBABBCCBACCBCCBCABABBCBABACBAABBBACAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBBAAABBABCBABBCCBACCBCCBCABABBCBABACBAABBBACAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe" start= auto displayName= "UserDataSvc_ACCBBAAABBABCBABBCCBACCBCCBCABABBCBABACBAABBBACAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBBAAABBABCBABBCCBACCBCCBCABABBCBABACBAABBBACAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBBAAABBABCBABBCCBACCBCCBCABABBCBABACBAABBBACAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2440

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:672

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACBAABAABBCCCABAACABBABCACBBCBCBBBBBAABBBABCBBBAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACBAABAABBCCCABAACABBABCACBBCBCBBBBBAABBBABCBBBAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe
1⤵
- Executes dropped EXE
PID:764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9cea2e29ca2c4d7b33a4434a2354ca0537ac97444e6b864452a74c1c918edd8d
MD5 55691ab0d00d2251a8aeb78c0f9b5136
SHA1 698313319054297a49f4bfe339a547a7d5d4f999
SHA512 199da9d8044609458d87922329fdb05dbd1b955257cdf337ead233021f797a8362b4821aa77f7387cff0c7438a67aa3ec09f98289140d8a39f5358cd73e72521
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 04cc3448dd74d4a78facdf110ad8a1684a5e9cceea001a1f90fc979ba5084a62
MD5 869c28c5d2f8f9785cb97b6ace55025b
SHA1 0cbcc19d2e1946911c7862bc0516182076ece9ed
SHA512 270deea01dcdf109945949b395579c57c9193ca46f0cbd8f41412c5f5fc5befb35580264ffd67d46b9948265a5107115c3e83ff60acf16bff94a2534b67538a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e4888a0e171ef3d000272a80f84b0577e02531bf4075143f7b8785b080dc9052
MD5 d969a80a5b4be7198236919c9cf3c5de
SHA1 da7532cde2bacac72d9a293e335d55133d834869
SHA512 4a2f0d2abe8bce5e285b41067dfff24ed0455e506f7bc1da1099102ad1311b31de57a66f043366d10072bda9d87be05a1472e8aa815c7e9ecfa8919f508467e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2abb2f50638b4c9682de9d028736abbfda46020ea96348bcddd3f68bf5910a18
MD5 1a1e8c8035cafa63542fdca768175a34
SHA1 7ec70c066cfae26af4f18900dfab35f5d76b3a0e
SHA512 d7941d35d59d28f83fb1f496912770991c9d21ce35ea3b4c84cd257141b592209e79934afb12bdac9a53b580bc9f6c30a6606d6fcdca7ac4b4e4f500d25d0e41
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f6081cbfe7552a867d31f8d4fbe733b261ba46197122e5571600988f09f48557
MD5 11f1ca238aeb727bd926f3e48f8b3dc3
SHA1 e84028bd98c09535ca84ef502e157305740c5fe9
SHA512 45d355c977890829021caeab1e8373d4650876e0550f96228ebfe25e5be5b941c4c46f2bc71532fc08a3d51dcbd7d009858043e525541e117c7c1850372ce12c
MD5 SHA1 SHA512

Submit Download

svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACACCBBCCCCBBCCCCBBBABBCCCAACCCABACBABABAABACCCABAB.exe
Size 10.8MB
SHA256 eef9f110c8ad1332306564fb3e5cd6c228a6800683dfe71f19bf40097348c4ab
MD5 e575eb950a93c8bfb7bf7a40e05f657e
SHA1 20f013797f626e517bd1b113f3afa5f3088f7bd1
SHA512 9cee905656a3991267c15c0d33a0e40db56d4d8f95eeb96c1508824ee9d1b9d5b8beaa628635b00a32ad44e7f56362c17464352b1ca3854594e810bacf791e99
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+ET+Ee+ES+EX:Fp7z
TLSH
T134B62909F94340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4ECB5B6523BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 21764e0b6da9ad862bd82c6638bed04feeb2a666f7f2810a3574b8f5dd028cd5
MD5 63825adf0e35fbbe41622e736808a29d
SHA1 e9fcd7dd92a92711a93eaf7086b7c1b31899ea28
SHA512 4d37a6061dad96625d09d0f911d51aeb28694e7ef5b67f705554f38418ce87d2b1aedac84de9c113800fbe1ba978440ab4430e834bf50cae7460f2acff942824
TLSH
T17E01FE60E4F5D857E933A6D6932D9BE30CF47747289CEA041345412CAF94C314E154FD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1676-87-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/3520-59-0x00000000057E0000-0x00000000057E1000-memory.dmp

Download

memory/4284-27-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/4284-37-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/4668-8-0x0000000000EA0000-0x0000000000EC1000-memory.dmp

Download

memory/4668-0-0x0000000000EA0000-0x0000000000EC1000-memory.dmp

Download