88e290a9d02007e52ed4c7dd470468fc1ad57b4af1373b8f64ad28b5467593cd

Analysis

max time kernel
149s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 21:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_1e56c1aa91c98d9781edd833aa4d129f_coinminer_elex_hijackloader_vidar_wannacry.exe
Size 33.0MB
Sample260827-1k8hya1cmc
SHA256 88e290a9d02007e52ed4c7dd470468fc1ad57b4af1373b8f64ad28b5467593cd
MD5 1e56c1aa91c98d9781edd833aa4d129f
SHA1 4af78829b5962a83de323efe0177ef9c3c67daae
SHA512 c5bd3462e8146f5a167889482c9f313a10a93bd8fdb98f0f49150008c2dd642ac0025cc8db557e621addec88272b643b39dd204472fdc76420f0074717f60e88
SSDEEP 49152:U+E2+ES+ES+ElyR+ES+ES+Emq+ES+ES+E2+ES+ES+ElyR+ES+ES+Emq+ES+ES+EZ:4n7Oa
TLSH
T149773B09FA8710F1D977517049DBD27B8630BE2187218EFFE689D63A9D33B906838B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4d6-20.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4268	svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe
4448	svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBAABCAACBABABABAACABBCBBCBAACABBACCBBCAABAACBACABACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe"	2026-08-27_1e56c1aa91c98d9781edd833aa4d129f_coinminer_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBBCAACACABABCCCCCCCCBACAABCCBABABACCAACBBCABBAACCBBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABBCBABCAACAAACAABCCCBACCACACBCCCBABBAACCABACCBACCBAA.exe"	svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4380	sc.exe
3496	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2256	cmd.exe
2612	cmd.exe
5616	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_1e56c1aa91c98d9781edd833aa4d129f_coinminer_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3124	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5048	2026-08-27_1e56c1aa91c98d9781edd833aa4d129f_coinminer_elex_hijackloader_vidar_wannacry.exe
5048	2026-08-27_1e56c1aa91c98d9781edd833aa4d129f_coinminer_elex_hijackloader_vidar_wannacry.exe
5048	2026-08-27_1e56c1aa91c98d9781edd833aa4d129f_coinminer_elex_hijackloader_vidar_wannacry.exe
5048	2026-08-27_1e56c1aa91c98d9781edd833aa4d129f_coinminer_elex_hijackloader_vidar_wannacry.exe
4268	svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe
4268	svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe
4268	svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe
4268	svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5048	2026-08-27_1e56c1aa91c98d9781edd833aa4d129f_coinminer_elex_hijackloader_vidar_wannacry.exe
Token: SeDebugPrivilege	4268	svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 5616	5048	2026-08-27_1e56c1aa91c98d9781edd833aa4d129f_coinminer_elex_hijackloader_vidar_wannacry.exe	92
PID 5616 wrote to memory of 3124	5616	cmd.exe	94
PID 4268 wrote to memory of 5656	4268	svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe	95
PID 5048 wrote to memory of 2256	5048	2026-08-27_1e56c1aa91c98d9781edd833aa4d129f_coinminer_elex_hijackloader_vidar_wannacry.exe	96
PID 2256 wrote to memory of 4380	2256	cmd.exe	98
PID 5048 wrote to memory of 2612	5048	2026-08-27_1e56c1aa91c98d9781edd833aa4d129f_coinminer_elex_hijackloader_vidar_wannacry.exe	99
PID 2612 wrote to memory of 3496	2612	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-27_1e56c1aa91c98d9781edd833aa4d129f_coinminer_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_1e56c1aa91c98d9781edd833aa4d129f_coinminer_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCBBBCBCCBBCCCACBAABBABABCAACCBABBBCBCBACAAAABAAABABBCACBBBAAAACACABCAAAACBCBABAABABCAAABBBBCBABBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCBBBCBCCBBCCCACBAABBABABCAACCBABBBCBCBACAAAABAAABABBCACBBBAAAACACABCAAAACBCBABAABABCAAABBBBCBABBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBBCACBCCCBABCCAACBCCBBCBBCCABBCCCCBACBCCBACCABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe" start= auto displayName= "UserDataSvc_ABCBBCACBCCCBABCCAACBCCBBCBBCCABBCCCCBACBCCBACCABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBBCACBCCCBABCCAACBCCBBCBBCCABBCCCCBACBCCBACCABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe" start= auto displayName= "UserDataSvc_ABCBBCACBCCCBABCCAACBCCBBCBBCCABBCCCCBACBCCBACCABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBBCACBCCCBABCCAACBCCBBCBBCCABBCCCCBACBCCBACCABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBBCACBCCCBABCCAACBCCBBCBBCCABBCCCCBACBCCBACCABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3496

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5656

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe
1⤵
- Executes dropped EXE
PID:4448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBABCAACAAACAABCCCBACCACACBCCCBABBAACCABACCBACCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBABCAACAAACAABCCCBACCACACBCCCBABBAACCABACCBACCBAA.exe
1⤵
PID:1372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 760b337a5a98055d717fd83a68dea029efa05473b93f9eb39f0e4463d2d28f28
MD5 d3865536c5c2bc4f0498427b8f5b8005
SHA1 f94c1996526b0063c295284826957ce1d4374fe8
SHA512 7e77bcce0a2ce8343fd09652388d19e30ab2291b0734775bca72c2ffff164919aacf8f7af7a31ae79294566aae63530b7976a0e344f66ba7dee4474a9d2adf28
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 38f95d6a0fc23f9094267775bbf3335d5e371aff2cdb1c6a054140526440999a
MD5 94491613e1327cf3accd9f80f5a6ff6b
SHA1 af9d03a72448b2f956d09586dec3ff5721b70727
SHA512 6469542a1855acdc6790d7477bc5de0a347421df7de18207c659d62b2950f88da70657aae12935d608023a44dda9fc380efc41eac8eff0dd87caa2974ab41d0b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 147bb29ff5b17477cde6502652c2fa32793ce38123a7b11747d9dd45770eaf25
MD5 17880b92aac787d5ac9e85ea04ffd12b
SHA1 24208edb2b2eb5c47006dd11a5f398af28bd96d5
SHA512 5b04f689e286b95cd5d9f229a9509e72c804441fba81570209970f6008dcaee676469ed254da8972f832614cbc6eb7e1ac77297f1874ffa8f53f23797b510806
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ed188343fa0d1a09abd74914dfc0d709eb39f55ef6cfad3aef60103ec36fe0cd
MD5 3a3562dd36396f9ac84834c84e85f65f
SHA1 a20e307bb7f9e4f2bb71f07cf004b2015f5778c8
SHA512 f36ed799cc6e9c1e2b696def19580219f84ee00fa01f5c0870f4e1e2c839851c37c4980506768bcf17baa1ac0b0c3da7002217c91d81c4ac16047e6a38b9093f
MD5 SHA1 SHA512

Submit Download

svchost_BBABBCBABCAACAAACAABCCCBACCACACBCCCBABBAACCABACCBACCBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBABCAACAAACAABCCCBACCACACBCCCBABBAACCABACCBACCBAA.exe
Size 12.5MB
SHA256 2a762da7319c768fb7afe48ed492cb218348961a70189362144c651c50a67e76
MD5 fab87e2c23e206dbd164e57eb3f44143
SHA1 8071f06a8cd543ae1bd92c132bc5cd0d8843075c
SHA512 05575d8ef5ff4fa986eadec6c68dac98cb95525a4274a98e2adb2c6d1a742bbb3c68d75574e737a03e9aaf29970d68003b7e5628c434f92c37dac90b51fe08b7
SSDEEP 49152:U+E2+ES+ES+ElyR+ES+ES+Emq+ES+ES+E2+ES+ES+ElyR+ES+ES+Emq+ES+ES+Ee:b
TLSH
T133D63B09FA8710F1D977517049DBD27B8630BE2187218EFFE689D63A9D33B906838B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe
Size 33.0MB
SHA256 88e290a9d02007e52ed4c7dd470468fc1ad57b4af1373b8f64ad28b5467593cd
MD5 1e56c1aa91c98d9781edd833aa4d129f
SHA1 4af78829b5962a83de323efe0177ef9c3c67daae
SHA512 c5bd3462e8146f5a167889482c9f313a10a93bd8fdb98f0f49150008c2dd642ac0025cc8db557e621addec88272b643b39dd204472fdc76420f0074717f60e88
SSDEEP 49152:U+E2+ES+ES+ElyR+ES+ES+Emq+ES+ES+E2+ES+ES+ElyR+ES+ES+Emq+ES+ES+EZ:4n7Oa
TLSH
T149773B09FA8710F1D977517049DBD27B8630BE2187218EFFE689D63A9D33B906838B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBCACABAAACACCACBACBACAAACCABAACBCCCCCBAACACCCCABAB.exe
Size 22.4MB
SHA256 83f82d881e74ba0d643d96afeb013844e959fd31e8a03731396f216f11dd566a
MD5 78f00676f5f9d426d2de39553d31df57
SHA1 d6990ab33f8019d26ea00a8d26b15e87b1868709
SHA512 58b1136cee01c5cfaf320e03630d46d12c991226c0a5b583407b295678c4acc268dcf7978ef25014371d9d08309fee61bbde8b1eb4c0d553f14053637642b075
SSDEEP 49152:U+E2+ES+ES+ElyR+ES+ES+Emq+ES+ES+E2+ES+ES+ElyR+ES+ES+Emq+ES+ES+EJ:A
TLSH
T103373B09FA9710F1D977417049DBD27B8630BE2187218EFFE689D63A9D33B906838B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4268-24-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/4268-34-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/5048-0-0x0000000000D20000-0x0000000000D41000-memory.dmp

Download

memory/5048-8-0x0000000000D20000-0x0000000000D41000-memory.dmp

Download