bf4312c43693540c512d6b1b2343857e0aee9f80ab6994c43875a90d93e5d100

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 11:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_446996d63a073110f0e3b8f4062d2610_elex_stop.exe
Size 402KB
Sample260816-m9cwnsweqa
SHA256 bf4312c43693540c512d6b1b2343857e0aee9f80ab6994c43875a90d93e5d100
MD5 446996d63a073110f0e3b8f4062d2610
SHA1 9d22efe266dcf78d7fc8bdcfc77fac8e8649fca7
SHA512 69598a0eb75d1db7e43046ea96707d6b5f960041c4b7246a6ac87080ab13dd84dd20d5c2b9c9bfdad0ac319ed321f5f3cbb58efaae902dcdd6b87300ead43dbd
SSDEEP 12288:mgUFgEsnojA9gUFgEsntzLQa0wIk0BX3RKuemGd70ioE:m9+EM0q9+EMt3QafDd70iT
TLSH
T155948D14F9434036E96724B08DDFD2BE9668AA314B124DD7E7CC89376E71BE1B23431A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1188	svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe
956	svchost_CBBAACAABBCACCAABABABCABBAAAAACAAAACABACBBABAAACAACABAB.exe
3292	svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBABBACACBCACBABABCBBCCBABACBAACBCCABAACCCCCCABCCBCACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe"	2026-08-16_446996d63a073110f0e3b8f4062d2610_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABAAAAABCBBCABACCAABCABBACCCBAABCCACCBCCCAACACABACABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBAACAABBCACCAABABABCABBAAAAACAAAACABACBBABAAACAACABAB.exe"	svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2816	sc.exe
5080	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4392	cmd.exe
2788	cmd.exe
5124	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBAACAABBCACCAABABABCABBAAAAACAAAACABACBBABAAACAACABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_446996d63a073110f0e3b8f4062d2610_elex_stop.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2364	2026-08-16_446996d63a073110f0e3b8f4062d2610_elex_stop.exe
2364	2026-08-16_446996d63a073110f0e3b8f4062d2610_elex_stop.exe
2364	2026-08-16_446996d63a073110f0e3b8f4062d2610_elex_stop.exe
2364	2026-08-16_446996d63a073110f0e3b8f4062d2610_elex_stop.exe
1188	svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe
1188	svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe
1188	svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe
1188	svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	2026-08-16_446996d63a073110f0e3b8f4062d2610_elex_stop.exe
Token: SeDebugPrivilege	1188	svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 4392	2364	2026-08-16_446996d63a073110f0e3b8f4062d2610_elex_stop.exe	91
PID 4392 wrote to memory of 3544	4392	cmd.exe	93
PID 1188 wrote to memory of 4640	1188	svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe	94
PID 2364 wrote to memory of 2788	2364	2026-08-16_446996d63a073110f0e3b8f4062d2610_elex_stop.exe	97
PID 2788 wrote to memory of 2816	2788	cmd.exe	99
PID 2364 wrote to memory of 5124	2364	2026-08-16_446996d63a073110f0e3b8f4062d2610_elex_stop.exe	100
PID 5124 wrote to memory of 5080	5124	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-16_446996d63a073110f0e3b8f4062d2610_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_446996d63a073110f0e3b8f4062d2610_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACABBBAACACAABBCCBABBBBACBCCABCAACCCAAABAABAAABCBBBCBBAABCACCBCABBCABCCCCACAABAAACBABBCBBCCBAABAABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACABBBAACACAABBCCBABBBBACBCCABCAACCCAAABAABAAABCBBBCBBAABCACCBCABBCABCCCCACAABAAACBABBCBBCCBAABAABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCBCBCBCAAABABCCCBACAACACCBBAAAACBBAACAAABBCCABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe" start= auto displayName= "UserDataSvc_CBCCBCBCBCAAABABCCCBACAACACCBBAAAACBBAACAAABBCCABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCBCBCBCAAABABCCCBACAACACCBBAAAACBBAACAAABBCCABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe" start= auto displayName= "UserDataSvc_CBCCBCBCBCAAABABCCCBACAACACCBBAAAACBBAACAAABBCCABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCBCBCBCAAABABCCCBACAACACCBBAAAACBBAACAAABBCCABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5124
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCBCBCBCAAABABCCCBACAACACCBBAAAACBBAACAAABBCCABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5080

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAACAABBCACCAABABABCABBAAAAACAAAACABACBBABAAACAACABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAACAABBCACCAABABABCABBAAAAACAAAACABACBBABAAACAACABAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe
1⤵
- Executes dropped EXE
PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ac6810c7aaad50a3b95fe51f65c4d37b9f78593c97bfe5feba1bc14ddc6a9a57
MD5 7e65dca6037553fb3ae424a6cb7ad4e0
SHA1 b8e16e74d70ed5a8e383e07f2fd8edfafaddeadc
SHA512 9c6d9794fba352f2e143fe7c5de7d00ed5ef3d5faa3311ba50bc0d741373f244357a15073209bf6ddabaea0deee6dc6e5b7da8360421ca965d7224bf796ac4c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7441d3ec3c2fd58c080b9e57c9b56793b87167cf8d4f468e1b28b5f0a823fc28
MD5 b7cb6641745e1576a9ae08bf35e019a7
SHA1 46f4b9edd50f078ecc684c4a2f8111024e818f4d
SHA512 e852e7bbc17625ebcd4ce3a1181d11eac2ef890e0d2c9d991f2988a52d2523050be81702a3fad01e7a434a4bf38370c75fa07bc0d716e51116a58b2571f0f0b9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 12839f3d8cacda694c6dc256521b10d4bd08357277bfa966d05e35cf87a8e0d2
MD5 aaff00cb1cde49a25ea85768a78c89b0
SHA1 acbd6541db770706b1692331e66eaf9274c1387a
SHA512 1ef8b7076da19ae7311abf71e9c85cec6cf786d3cb2efe32753cb04770c73a8705febeafcce5338e06dd958ff29057ed23b7ccafd755057fd736365575fe8050
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3e79b7835ba3ee9c9b8ce9404bdcb3d56c37713d4b8787b70f75b70e268b880f
MD5 aa2c9b4e5914c48dbb68c229e53b4ec8
SHA1 d029638dd633fa93dc393d68d2dc38f1f5dd469d
SHA512 d8e2dd8b60b29662f1e5dfe06ea5c1ad9619820145c7ed1fc80ba31613187ca4b54146285d924819beb22697482da92157c57af10b0b976f99f1fa8d455b4bfd
MD5 SHA1 SHA512

Submit Download

svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBABABAABCBACCABAACCBCACBCBAACCBCCABBACABCCBBAAACC.exe
Size 402KB
SHA256 bf4312c43693540c512d6b1b2343857e0aee9f80ab6994c43875a90d93e5d100
MD5 446996d63a073110f0e3b8f4062d2610
SHA1 9d22efe266dcf78d7fc8bdcfc77fac8e8649fca7
SHA512 69598a0eb75d1db7e43046ea96707d6b5f960041c4b7246a6ac87080ab13dd84dd20d5c2b9c9bfdad0ac319ed321f5f3cbb58efaae902dcdd6b87300ead43dbd
SSDEEP 12288:mgUFgEsnojA9gUFgEsntzLQa0wIk0BX3RKuemGd70ioE:m9+EM0q9+EMt3QafDd70iT
TLSH
T155948D14F9434036E96724B08DDFD2BE9668AA314B124DD7E7CC89376E71BE1B23431A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1188-24-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/1188-34-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/2364-0-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/2364-8-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download