0995246f286ef29a547c6847bef54fa752cdf898bf43b14d2a6b5b98cc888b70

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_fd06961875235d0ae080f102869b28fc_coinminer_elex_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
Size 1.5MB
Sample260824-xpzvtasdmd
SHA256 0995246f286ef29a547c6847bef54fa752cdf898bf43b14d2a6b5b98cc888b70
MD5 fd06961875235d0ae080f102869b28fc
SHA1 889d6d53330abe0468c9e143e1cc8f4257998cbd
SHA512 4e9acb042b28c0c7043dd2bf5bf68b7b5a96dc8b484e97bb632a237240cd72e2977c9c6378477bd7f9934ecd6ccbb39de133b63a140ba1d9ae0d1a44e4cc05fb
SSDEEP 24576:m9+EM0k19+EM0qOslZOZGgU8u/OfDlEUKWflmTP3wGICRn3/GzPAqu:U+E2/+EYu5fU4UjwER3/Gza
TLSH
T19975B026B1A100F1E5F201719919D135EE35FE341720CAAFE3D4FA2E6F32591AE3A752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2552	svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe
3528	svchost_CCBBCBACBBACBBCABACAACCBBCBBBBCCAAACBBCACBBCBACBCAABCBB.exe
824	svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCABBBBCABACCCBCBCACACBCBACCCBACBAACBBAACACCBBCBACAACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe"	2026-08-24_fd06961875235d0ae080f102869b28fc_coinminer_elex_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCBBBBBCBBCAABACABABCCABBABACACACCBABCBBCBBACBBABCBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBCBACBBACBBCABACAACCBBCBBBBCCAAACBBCACBBCBACBCAABCBB.exe"	svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4620	sc.exe
1680	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3312	cmd.exe
2260	cmd.exe
4368	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBCBACBBACBBCABACAACCBBCBBBBCCAAACBBCACBBCBACBCAABCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_fd06961875235d0ae080f102869b28fc_coinminer_elex_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4284	2026-08-24_fd06961875235d0ae080f102869b28fc_coinminer_elex_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
4284	2026-08-24_fd06961875235d0ae080f102869b28fc_coinminer_elex_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
4284	2026-08-24_fd06961875235d0ae080f102869b28fc_coinminer_elex_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
4284	2026-08-24_fd06961875235d0ae080f102869b28fc_coinminer_elex_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
2552	svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe
2552	svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe
2552	svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe
2552	svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe
3528	svchost_CCBBCBACBBACBBCABACAACCBBCBBBBCCAAACBBCACBBCBACBCAABCBB.exe
3528	svchost_CCBBCBACBBACBBCABACAACCBBCBBBBCCAAACBBCACBBCBACBCAABCBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4284	2026-08-24_fd06961875235d0ae080f102869b28fc_coinminer_elex_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
Token: SeDebugPrivilege	2552	svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe
Token: SeDebugPrivilege	3528	svchost_CCBBCBACBBACBBCABACAACCBBCBBBBCCAAACBBCACBBCBACBCAABCBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 2260	4284	2026-08-24_fd06961875235d0ae080f102869b28fc_coinminer_elex_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe	92
PID 2260 wrote to memory of 460	2260	cmd.exe	94
PID 2552 wrote to memory of 2304	2552	svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe	95
PID 4284 wrote to memory of 4368	4284	2026-08-24_fd06961875235d0ae080f102869b28fc_coinminer_elex_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe	98
PID 4368 wrote to memory of 4620	4368	cmd.exe	100
PID 4284 wrote to memory of 3312	4284	2026-08-24_fd06961875235d0ae080f102869b28fc_coinminer_elex_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe	101
PID 3312 wrote to memory of 1680	3312	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-24_fd06961875235d0ae080f102869b28fc_coinminer_elex_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_fd06961875235d0ae080f102869b28fc_coinminer_elex_hijackloader_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACCBCAACABBCABABBCAAABBCAAACCCBAACCCAABAABBCCCAAACBBCCCAACCCCBBBACBACACBCCAAABCABCBAACCCABABCACCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACCBCAACABBCABABBCAAABBCAAACCCBAACCCAABAABBCCCAAACBBCCCAACCCCBBBACBACACBCCAAABCABCBAACCCABABCACCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCACACACAAABBCBAAAACBABBCBCCACABBCACBCCCCACCCCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe" start= auto displayName= "UserDataSvc_BCBCACACACAAABBCBAAAACBABBCBCCACABBCACBCCCCACCCCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCACACACAAABBCBAAAACBABBCBCCACABBCACBCCCCACCCCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe" start= auto displayName= "UserDataSvc_BCBCACACACAAABBCBAAAACBABBCBCCACABBCACBCCCCACCCCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCACACACAAABBCBAAAACBABBCBCCACABBCACBCCCCACCCCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCACACACAAABBCBAAAACBABBCBCCACABBCACBCCCCACCCCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2304

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBACBBACBBCABACAACCBBCBBBBCCAAACBBCACBBCBACBCAABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBACBBACBBCABACAACCBBCBBBBCCAAACBBCACBBCBACBCAABCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe
1⤵
- Executes dropped EXE
PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa6d4ed9e6047f013ae82545352acf6f4e7a498c9d20064f518c89ff3f59d67d
MD5 ccbad55540b2c164cd137bdb5cf0b809
SHA1 b1f91954e5143f632d35e0440dcc11a99373a984
SHA512 ccbf9dcb3219e3c56a0ab68bcfbb352dc1ca3d7adf862c56c35e6e9576d7187af27f672ba7e77daae5a5a4bd614ce0ade114d4e04d61590901f0618debfe41f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9101047b3d3dac605c05cf4759e56e5925d1666e5d73007509de264d377f50b
MD5 f95d8801e1cc405e7f93538d18e66d85
SHA1 6929030560c364b57916716e32868952815696d4
SHA512 329adb295a539a967cff392a8551eaf6b23f70d9c4998db0718e7896448226dea36b88d1b980e4750f36f2565bd6186dedcfeffb86cd774416c55dd1a5cb885f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e78e6f7ed3f3b63be811590b03a365b73dbbdf0691019b81cd2b2cd092aed3d2
MD5 48825ac145e2c787ea3933c285ef31f1
SHA1 826dfaf319e26032182d84d14ab537eff7245d77
SHA512 ab2cfca20a8f3a2fa1f35493b52149fe40913e5b85bf3579201bcb555ae4be2a11bb84e57693dcb47b48819f87dd6985b328cc91fb4cb4affcd2eb3ea2cd3631
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 14458bec45a7be42ee3c99e32cfb8966ed50644219942bac345452f5da2361db
MD5 c53f6c1d23c550ce846d93b998870ca2
SHA1 a4e8e84b3c9b9cf902f4d065649654ae503b1ffe
SHA512 eb6a308c04b5046b0944c6bc94727340e3ca98c11da5d3e209788fb01a4f1d01b0b845548d33e50fa88ec6d60c9f16abd76bd5d398049ded2c2849e556a837b9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fb303711f4b686f25765f1c03a9776d2ddeeacea62f51520691fa7521ee59fac
MD5 1b3a9767a6133446435068421efb16b1
SHA1 0f9f280ae4b09e173af3add988b4f77374e28272
SHA512 08a22ffd42e322faaec9784c18ed9067bf61f0255d20ea57504b3d94491e1acbc225141aa5e4dbfaaec288b8c79987815c4770a1519cc84af39f5ed0d6ef54a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 292f034077278d6c642d9348a067f2373d0f20547c5422ac49ff751a411784a8
MD5 fa5b0bb2de163218488a9db1b05af98d
SHA1 6cc3d0d84616155fda78f65992d1645dd7c2f946
SHA512 df6825c7ba290ea004143d3c0c916a7bdb56b053d352228774aceec748739233fabc0d6c2925ab16f9785945dfaa97e68408954e6b30ee154eb0e0f6083ca61c
MD5 SHA1 SHA512

Submit Download

svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBABCABBCBBBCAACAABCACBCCBCCCABBCACCCBCAACACBBBBABA.exe
Size 1.5MB
SHA256 0995246f286ef29a547c6847bef54fa752cdf898bf43b14d2a6b5b98cc888b70
MD5 fd06961875235d0ae080f102869b28fc
SHA1 889d6d53330abe0468c9e143e1cc8f4257998cbd
SHA512 4e9acb042b28c0c7043dd2bf5bf68b7b5a96dc8b484e97bb632a237240cd72e2977c9c6378477bd7f9934ecd6ccbb39de133b63a140ba1d9ae0d1a44e4cc05fb
SSDEEP 24576:m9+EM0k19+EM0qOslZOZGgU8u/OfDlEUKWflmTP3wGICRn3/GzPAqu:U+E2/+EYu5fU4UjwER3/Gza
TLSH
T19975B026B1A100F1E5F201719919D135EE35FE341720CAAFE3D4FA2E6F32591AE3A752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 da9efe40f08b0e0d008ef1caedfb3dfa45865500a0290c8277b5499fd9674529
MD5 9acac909576056a8ecbd3d22b262ae3b
SHA1 db8f5f2039558fa4b472473ae85598368f0682b7
SHA512 d4a38c6c31fcfba174c058bc25369a0537de1b652ae3ea58a324d5c719ba695fb1558704bca0d845534076cafb030e0f550359ce6312f19db15b851671545adb
TLSH
T19711EE50B0F5DC23F432E8CB5719DAD328E476869C5C5A143318D51DBFC6C328D998E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2552-32-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/3528-79-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/4284-0-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/4284-8-0x00000000001F0000-0x0000000000211000-memory.dmp

Download