26f946ebbee81ed503c1ff0a861f712406fdc581492e8a1fd183a37b7e30c859

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_5367fd5c2f53ca6a062ff99121984342_elex_stop.exe
Size 8.6MB
Sample260814-e2417acp4v
SHA256 26f946ebbee81ed503c1ff0a861f712406fdc581492e8a1fd183a37b7e30c859
MD5 5367fd5c2f53ca6a062ff99121984342
SHA1 081a34eb5c47aa0a22479acd0c714b32136f8602
SHA512 01d993c5ef073011a54ca458ac58c34782c2b1738f49945a6520907054deb39e3b8ad5ad6b8e6db8d31b6db7fd173c8f43e88799397140165abd7e9b84aa0acb
SSDEEP 49152:U+ES+ES+ES+ES+ET+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+Ec:hp70
TLSH
T1D9962909F94340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4ECB5B6523BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2600	svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe
4320	svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe
4296	svchost_ABBCBCABBCBACCCAABCBABCCCCBAABBABCBAACBBBCCBACBBACABCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACBBCBBCBBCBCCCABAABBAACBBAAACBBBBCBAACBBCCBCBAAACBBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe"	2026-08-14_5367fd5c2f53ca6a062ff99121984342_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCAAAACBCABCBACBABCCCCCBACBBBAABABCBCCACABAAAACCBBBBCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCBCABBCBACCCAABCBABCCCCBAABBABCBAACBBBCCBACBBACABCCB.exe"	svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4000	sc.exe
1576	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1984	cmd.exe
1116	cmd.exe
1804	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCBCABBCBACCCAABCBABCCCCBAABBABCBAACBBBCCBACBBACABCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_5367fd5c2f53ca6a062ff99121984342_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2592	2026-08-14_5367fd5c2f53ca6a062ff99121984342_elex_stop.exe
2592	2026-08-14_5367fd5c2f53ca6a062ff99121984342_elex_stop.exe
2592	2026-08-14_5367fd5c2f53ca6a062ff99121984342_elex_stop.exe
2592	2026-08-14_5367fd5c2f53ca6a062ff99121984342_elex_stop.exe
2600	svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe
2600	svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe
2600	svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe
2600	svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2592	2026-08-14_5367fd5c2f53ca6a062ff99121984342_elex_stop.exe
Token: SeDebugPrivilege	2600	svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1548	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1804	2592	2026-08-14_5367fd5c2f53ca6a062ff99121984342_elex_stop.exe	100
PID 1804 wrote to memory of 2552	1804	cmd.exe	102
PID 2592 wrote to memory of 1984	2592	2026-08-14_5367fd5c2f53ca6a062ff99121984342_elex_stop.exe	106
PID 1984 wrote to memory of 4000	1984	cmd.exe	108
PID 2592 wrote to memory of 1116	2592	2026-08-14_5367fd5c2f53ca6a062ff99121984342_elex_stop.exe	109
PID 1116 wrote to memory of 1576	1116	cmd.exe	111
PID 2600 wrote to memory of 2112	2600	svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe	113
PID 2112 wrote to memory of 3348	2112	notepad.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-14_5367fd5c2f53ca6a062ff99121984342_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_5367fd5c2f53ca6a062ff99121984342_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCAAACCCAABABBABABCAAACABBCCBBCACCAAAAAAACBABCBCCBAAABACCBCACBACACCACCCBBACBBABBBCBCCABACACCCBCBACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCAAACCCAABABBABABCAAACABBCCBBCACCAAAAAAACBABCBCCBAAABACCBCACBACACCACCCBBACBBABBBCBCCABACACCCBCBACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACACCACAABCBCAAAACCAAABAAABCBCAABAABBCBBCBBABAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe" start= auto displayName= "UserDataSvc_AACACCACAABCBCAAAACCAAABAAABCBCAABAABBCBBCBBABAACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACACCACAABCBCAAAACCAAABAAABCBCAABAABBCBBCBBABAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe" start= auto displayName= "UserDataSvc_AACACCACAABCBCAAAACCAAABAAABCBCAABAABBCBBCBBABAACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACACCACAABCBCAAAACCAAABAAABCBCAABAABBCBBCBBABAACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACACCACAABCBCAAAACCAAABAAABCBCAABAABBCBBCBBABAACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe
1⤵
- Executes dropped EXE
PID:4320

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1548

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCABBCBACCCAABCBABCCCCBAABBABCBAACBBBCCBACBBACABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCABBCBACCCAABCBABCCCCBAABBABCBAACBBBCCBACBBACABCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 72168c6ee0bc51fb2b300231a1cf8bc6b3bbe2820db1819bae02de2b197664b3
MD5 76d3725b8157b5cb5f77fd99c7a03f24
SHA1 f2637084ad1e1ccbeb98aa8fc846b5c156673b6f
SHA512 9de144278fa66a4fb3d655eeaf623cc5a06cce9124c01db37a1c21604205cf000b6c65a9914c007f38c849a3c27d27f97611b89bbfe11d1bfe89174ebad1fb9c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c3ad80e04ae339cbafaaac5ec6f74233b054f608ed36cb31932107213232cd31
MD5 92a97146be4ffcec35ab26878c1a7400
SHA1 2d511278736628e380d523bef45332b504f0c454
SHA512 dfe0b7371aaa39c3648f78bc354a427670718ecb71f6ed6cd3905905df3ce48d7016abc05b4530abb0146d77b2bd7b85fa07078cb6c1c913698f80d7bd2ccaae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 755f63f6ad469e95b4720ecc1da2aa5ba02e0b27d7e866f52ba2d89aed6fab1b
MD5 c9db13497e56fd1d1e168b5888f2a088
SHA1 a1d79aa3496306d102924a26080194a1fdee3dba
SHA512 ea4d7440a890610b338e0883da531ce43a75e00c69b5bae0b1e32f1a6ad5bae79b2a79115b47295c626896e81751e4dcfa1db765934affac134470d33e58bbd5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 46d2a0e46c8cee0df53c9e1e16c8c169c7e51685d04a72d8e3a782445a2ae6d3
MD5 137fc7622a6c8884606727440bfa36df
SHA1 d77dc7b97d9339a9ef20d886ff959b19fb30d2ee
SHA512 9f16ba4e982b116b09ffd549cc4c9204a42986411d9d5601946606fd29e5333b07a4ee9cc999a6c10c498ae18851369f4b03cc91eb1131caf304f9c410df8039
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b1227f9e0581edf28b6b69581f6ccd23b5542423a2eadf5ac63bcf8a6837fb6e
MD5 eda32bd7bda35df41485871d6fbbe182
SHA1 a064bb17b1175e4a20336ac8c74c970e0c138ce7
SHA512 84f01dd3af133219723f238a70958306200cc6d3c77d45849fabc4ed567048b99afecd9f222773b863ad2344e753a048c5122a21f32e9c26f22ab73d685b7dce
MD5 SHA1 SHA512

Submit Download

svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBAACABCABBBBBCACCCBACBCABCACCCCAABBACCAACCBBCBABBA.exe
Size 8.6MB
SHA256 26f946ebbee81ed503c1ff0a861f712406fdc581492e8a1fd183a37b7e30c859
MD5 5367fd5c2f53ca6a062ff99121984342
SHA1 081a34eb5c47aa0a22479acd0c714b32136f8602
SHA512 01d993c5ef073011a54ca458ac58c34782c2b1738f49945a6520907054deb39e3b8ad5ad6b8e6db8d31b6db7fd173c8f43e88799397140165abd7e9b84aa0acb
SSDEEP 49152:U+ES+ES+ES+ES+ET+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+Ec:hp70
TLSH
T1D9962909F94340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4ECB5B6523BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2112-67-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Download

memory/2592-6-0x0000000000540000-0x0000000000561000-memory.dmp

Download

memory/2600-25-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/2600-38-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/4296-82-0x0000000000720000-0x0000000000741000-memory.dmp

Download

memory/4320-72-0x0000000000310000-0x0000000000331000-memory.dmp

Download