4099e2484e6cbcf2d9f06952e1e2e6d674f86c46475462c5fc38b6cf1c3afb19

Analysis

max time kernel
151s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_c505007bccc66e15cf14d6bfac141d01_coinminer_elex_hijackloader_stop_vidar.exe
Size 51.3MB
Sample260819-e2nn7sytf1
SHA256 4099e2484e6cbcf2d9f06952e1e2e6d674f86c46475462c5fc38b6cf1c3afb19
MD5 c505007bccc66e15cf14d6bfac141d01
SHA1 98eb849bb658424b82dc6d8d03cea2d7533441cc
SHA512 1d634b2ba43cc8f47c7860e9be4d886d6aadf2cc966a452f62a8dfb6845cbe617ee7d0c8ed2d33fd19c82591636e203ae2a50e7e53787bb98b05c8019495f60b
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+Ee:Jp73p73p7jn7O6
TLSH
T189C75B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4172	svchost_CAAAAABBCCBABBCCAAABABCCBCCBCCCACCCAAAACAAABACACCACBCCA.exe
820	svchost_AAACCCCABBCAACCACAAABCAABBBCAACABCBBBACBABBAAACBBABCABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACAACACBBCBBBACBBBACCCBBAAABABBCCAACBBCCCCCABCCBBCAAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAAAABBCCBABBCCAAABABCCBCCBCCCACCCAAAACAAABACACCACBCCA.exe"	2026-08-19_c505007bccc66e15cf14d6bfac141d01_coinminer_elex_hijackloader_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABACCBCACABBAABABABCACCCBCBBBBBCAABBAACABCBABAACCCBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACCCCABBCAACCACAAABCAABBBCAACABCBBBACBABBAAACBBABCABA.exe"	svchost_CAAAAABBCCBABBCCAAABABCCBCCBCCCACCCAAAACAAABACACCACBCCA.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3328	cmd.exe
2620	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACCCCABBCAACCACAAABCAABBBCAACABCBBBACBABBAAACBBABCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_c505007bccc66e15cf14d6bfac141d01_coinminer_elex_hijackloader_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAAAABBCCBABBCCAAABABCCBCCBCCCACCCAAAACAAABACACCACBCCA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1164	2026-08-19_c505007bccc66e15cf14d6bfac141d01_coinminer_elex_hijackloader_stop_vidar.exe
1164	2026-08-19_c505007bccc66e15cf14d6bfac141d01_coinminer_elex_hijackloader_stop_vidar.exe
1164	2026-08-19_c505007bccc66e15cf14d6bfac141d01_coinminer_elex_hijackloader_stop_vidar.exe
1164	2026-08-19_c505007bccc66e15cf14d6bfac141d01_coinminer_elex_hijackloader_stop_vidar.exe
4172	svchost_CAAAAABBCCBABBCCAAABABCCBCCBCCCACCCAAAACAAABACACCACBCCA.exe
4172	svchost_CAAAAABBCCBABBCCAAABABCCBCCBCCCACCCAAAACAAABACACCACBCCA.exe
4172	svchost_CAAAAABBCCBABBCCAAABABCCBCCBCCCACCCAAAACAAABACACCACBCCA.exe
4172	svchost_CAAAAABBCCBABBCCAAABABCCBCCBCCCACCCAAAACAAABACACCACBCCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1164	2026-08-19_c505007bccc66e15cf14d6bfac141d01_coinminer_elex_hijackloader_stop_vidar.exe
Token: SeDebugPrivilege	4172	svchost_CAAAAABBCCBABBCCAAABABCCBCCBCCCACCCAAAACAAABACACCACBCCA.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 3328	1164	2026-08-19_c505007bccc66e15cf14d6bfac141d01_coinminer_elex_hijackloader_stop_vidar.exe	92
PID 3328 wrote to memory of 2784	3328	cmd.exe	94
PID 4172 wrote to memory of 5916	4172	svchost_CAAAAABBCCBABBCCAAABABCCBCCBCCCACCCAAAACAAABACACCACBCCA.exe	95
PID 1164 wrote to memory of 2620	1164	2026-08-19_c505007bccc66e15cf14d6bfac141d01_coinminer_elex_hijackloader_stop_vidar.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-19_c505007bccc66e15cf14d6bfac141d01_coinminer_elex_hijackloader_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_c505007bccc66e15cf14d6bfac141d01_coinminer_elex_hijackloader_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCACCACACBACACCBBBCCABBABCCABCBCBBBBAAACBCCCAACBCBAABABBABCBBAACCCCCABBCBBACAACAAACBCBCBAACBBABABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAABBCCBABBCCAAABABCCBCCBCCCACCCAAAACAAABACACCACBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCACCACACBACACCBBBCCABBABCCABCBCBBBBAAACBCCCAACBCBAABABBABCBBAACCCCCABBCBBACAACAAACBCBCBAACBBABABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAABBCCBABBCCAAABABCCBCCBCCCACCCAAAACAAABACACCACBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBABBBBAACCACBACCBCAACACCBABBBAAABBBCCCABCCCCCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAABBCCBABBCCAAABABCCBCCBCCCACCCAAAACAAABACACCACBCCA.exe" start= auto displayName= "UserDataSvc_AACBABBBBAACCACBACCBCAACACCBABBBAAABBBCCCABCCCCCCCB"
  2⤵
  - Executes a command shell one-liner
  PID:2620

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAABBCCBABBCCAAABABCCBCCBCCCACCCAAAACAAABACACCACBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAABBCCBABBCCAAABABCCBCCBCCCACCCAAAACAAABACACCACBCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCCCABBCAACCACAAABCAABBBCAACABCBBBACBABBAAACBBABCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCCCABBCAACCACAAABCAABBBCAACABCBBBACBABBAAACBBABCABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9bed3fa85403abed808ad12d1d005e9ea82c97693c7244a341fd47758c5a20da
MD5 a724b7b0217c237c9c0f04bb3885d8ab
SHA1 40427e52f6725d1fb9c5bb230dabdc6a8dcc10c8
SHA512 761c866b1b6c8d5fb80b7be543f9885566209cc27cf462ef19c56e1212c4e13e46f9603f9c66f8215c65a56087af5e5d7d65c2fbb72cefd1aeea808e37858e95
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4414de734440c9e0e619f39e9cbab6e3d53fa93aef83346118b8f69767fe84d2
MD5 7ab1dc1114d2ff7f49cd0b78452af6b7
SHA1 f32efacd28b040eeeb22355a764df71bc13e4abf
SHA512 5720bc20d3df2244ae594d6312dff7da4e5d2e731b4d1a6f2b7450adedf0e3b8f5a20eaa36aeaf8922d11ed17d77c32a197d6dbad7f525f7c053b3bc0458a3a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ba9d8f737b43511814c5620477c065c49fc654b87b157815f1284f5762103fce
MD5 c103b656c7152d20611ead373272dbbe
SHA1 75a7bc1239ae3a4f225935418726df836b3162f2
SHA512 bd4eca88abd9d55eb9b8bc7fc840e295469116d09e11db03ae703e23b7ecf38ce43d2f61a45e41933fa10fd8d91b80d984a439d1e4b3e5bb452f8f89d8792cf5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f340b8dd0bd63a94bb44f9436375e3c6e4dc206e1563373005aa309bb8c33fb4
MD5 db34e8adcd8fd9bff8ed1422e5509f45
SHA1 0ee0c21fc98f605636e4ae8b0e6989a83021bbd5
SHA512 dfeadeaec33bc483e3b1751d23d15babcb9b452622e575cf5f5711a480d79d1bd8bb3f33084b10d40849c5586dc9e9b36a2dc295b4b07c9322fa6f4e6aa8d906
MD5 SHA1 SHA512

Submit Download

memory/820-79-0x0000000000130000-0x0000000000151000-memory.dmp

Download

memory/1164-23-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/1164-47-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/1164-50-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/1164-12-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/1164-0-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/1164-72-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/4172-48-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/4172-70-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download