5552629647e018ca838535abe8afc3b68fbe2384ee9e1e53fd64cd8809677f0b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 05:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_f2d6fbb9476765461a97ad3cc647b316_elex_stop.exe
Size 6.3MB
Sample260827-gfd9razcmd
SHA256 5552629647e018ca838535abe8afc3b68fbe2384ee9e1e53fd64cd8809677f0b
MD5 f2d6fbb9476765461a97ad3cc647b316
SHA1 92eb53c470f5af15686574dfec63a0e40bb8ec16
SHA512 ce4d84f75ff08c2d8a4428fc325b376c5d6c0a586ebb52e71d4b6d3cb9fcf63569c7de4966bc890656547579bff9b903780d5813c8d7e53447faaf6ce7448065
SSDEEP 49152:U+Evb6/+EL+EL+Evb6Y+EL+Evb6/+EL+EL+Evb6Y+EL+Evb6/+EL+EL+Evb6Y+E1:9p7L
TLSH
T1ED665C09F69340F1E92BD0B08D9FD37BE7707A2285315E67EF99CA576E33B205918620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4832	svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe
3492	svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe
3108	svchost_BCACCBACBBBACCBACACBCBBABACBBBBCBBCBACAAAABAABCAAACACAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACACAABAACCABCBAABCCBCABBAACBCAACABCAABAAAAACACCAAAABAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe"	2026-08-27_f2d6fbb9476765461a97ad3cc647b316_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACBAABCBCAACCBAAAACCCCCBCABAAACCBAAABBAABABCABCACBACBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACCBACBBBACCBACACBCBBABACBBBBCBBCBACAAAABAABCAAACACAC.exe"	svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3800	sc.exe
3796	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1984	cmd.exe
2336	cmd.exe
4432	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_f2d6fbb9476765461a97ad3cc647b316_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACCBACBBBACCBACACBCBBABACBBBBCBBCBACAAAABAABCAAACACAC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1016	2026-08-27_f2d6fbb9476765461a97ad3cc647b316_elex_stop.exe
1016	2026-08-27_f2d6fbb9476765461a97ad3cc647b316_elex_stop.exe
1016	2026-08-27_f2d6fbb9476765461a97ad3cc647b316_elex_stop.exe
1016	2026-08-27_f2d6fbb9476765461a97ad3cc647b316_elex_stop.exe
4832	svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe
4832	svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe
4832	svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe
4832	svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe
3108	svchost_BCACCBACBBBACCBACACBCBBABACBBBBCBBCBACAAAABAABCAAACACAC.exe
3108	svchost_BCACCBACBBBACCBACACBCBBABACBBBBCBBCBACAAAABAABCAAACACAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1016	2026-08-27_f2d6fbb9476765461a97ad3cc647b316_elex_stop.exe
Token: SeDebugPrivilege	4832	svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe
Token: SeDebugPrivilege	3108	svchost_BCACCBACBBBACCBACACBCBBABACBBBBCBBCBACAAAABAABCAAACACAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2252	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 2336	1016	2026-08-27_f2d6fbb9476765461a97ad3cc647b316_elex_stop.exe	103
PID 2336 wrote to memory of 3692	2336	cmd.exe	105
PID 4832 wrote to memory of 2328	4832	svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe	111
PID 2328 wrote to memory of 2084	2328	notepad.exe	112
PID 1016 wrote to memory of 4432	1016	2026-08-27_f2d6fbb9476765461a97ad3cc647b316_elex_stop.exe	114
PID 4432 wrote to memory of 3800	4432	cmd.exe	116
PID 1016 wrote to memory of 1984	1016	2026-08-27_f2d6fbb9476765461a97ad3cc647b316_elex_stop.exe	117
PID 1984 wrote to memory of 3796	1984	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-08-27_f2d6fbb9476765461a97ad3cc647b316_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f2d6fbb9476765461a97ad3cc647b316_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBABCBACBCAABCBCAAAACBAABACAABCBCABACCCACBBBABCBBABCCBBACCCAAACBCCBCCBBCCCCCABABAACBBACAACCBBAAAABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBABCBACBCAABCBCAAAACBAABACAABCBCABACCCACBBBABCBBABCCBBACCCAAACBCCBCCBBCCCCCABABAACBBACAACCBBAAAABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACAABBBACBAAAAACCCCAABBBBBCBBBCCCACABBCBBBABACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe" start= auto displayName= "UserDataSvc_BBACAABBBACBAAAAACCCCAABBBBBCBBBCCCACABBCBBBABACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACAABBBACBAAAAACCCCAABBBBBCBBBCCCACABBCBBBABACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe" start= auto displayName= "UserDataSvc_BBACAABBBACBAAAAACCCCAABBBBBCBBBCCCACABBCBBBABACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACAABBBACBAAAAACCCCAABBBBBCBBBCCCACABBCBBBABACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACAABBBACBAAAAACCCCAABBBBBCBBBCCCACABBCBBBABACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2252

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe
1⤵
- Executes dropped EXE
PID:3492

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCBACBBBACCBACACBCBBABACBBBBCBBCBACAAAABAABCAAACACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCBACBBBACCBACACBCBBABACBBBBCBBCBACAAAABAABCAAACACAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 67262c4af8077f645e083ceb6f698bb67859cd52319e87a32ec8ac2adde19c90
MD5 cf37cdd2aeb47f9a6f2e34bc36b8d746
SHA1 39546ac71e9a6cb1e6d851e0eab856fdfd353a23
SHA512 828b27946531f90bdffbb240029090f8b02917bf50c6ff94961932524c40bcbee493036ca4032843697328a2b9a293c63e238c57317754960522bcaaa0e1c63d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cc0898731103a5e4d562aaa1976b6ff7938ee37990388829bde663c15bc76e06
MD5 6d94b49769c7218bba9bf070a7ba0892
SHA1 43352008f4b5f479b27a1ee3cb9c61b4c09b664f
SHA512 89deea9976795ca1d5314a41db889ad8edfbc78d36892b59257ddb57ff93fcfdf0dc4ff539345b1fae3d754df3b9445be5b4b60b6c19e5bd2046ba45dd93fafe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9dce0dc84e0f4b62faa7e726096e47bfc48e3fd7a88ac6f28b135b3618fa5e6c
MD5 ca7452abc3650b8216d392929f63ddaf
SHA1 8077bd898652a228667da48880732e28b79f36aa
SHA512 185d73d80b78769089c202656b30cd509a4af155579623ef669dd1bb9bba5b3c6d66047febf8c2596851b00329836a59c2a6161639f8e900f2012f1c143e5ceb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 375f669606bcca597bb83dfef67a52982e15d44a226d569e85c7b92e2c62618e
MD5 3dfc2c3f013ad1bae58785974ae3707f
SHA1 8e2a2eff43a415a71aeed27363ef9f60eb7fd39e
SHA512 fc4f5c42ed271fc22aa4ed372af87e3d972b9717817a4c85f4c43b7ad2dc35874f8eb2540116ab016c13e6b95bd9f5d1716449f0e33c6f013e54d8082a97016c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f368031560cee81720a94028e54fab80f89be45d9ed2b789059bdc56b8870f52
MD5 df26f1c2208f8e6496b516832b8964ac
SHA1 de4f95edc84f56c1ae7e66f6ea20192e7221c757
SHA512 3cc79b95e531ac06b61f57205ae6def677beae3e50560ef6d65c5b4a4a31f304f84960a4baab03eef9dfb6baaae219af4f0a791ee4216ba92ed17c15fc9eb08e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c24e342f538fccae6c539c2a3c4faac2a380ef3f4ad3e11fa3ce65ab938d5880
MD5 d9ee185089ee969f6e51d3c276c9bb36
SHA1 6ebffa7eda5e18b5b1aad07a2ac1909dd610abbe
SHA512 f0654a1e7c6f2c594c083d12b772cbdc407d926d239c8cd3ee02f8c2db0a47c1e997944329f073e59d5b404fa8d79b4dbc1872bf94c7ea3fab5c441eca0978ff
MD5 SHA1 SHA512

Submit Download

svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBACABAABBBBBCAAACCBBBBAAACCBBBBACCCAABAAAABACACACB.exe
Size 6.3MB
SHA256 5552629647e018ca838535abe8afc3b68fbe2384ee9e1e53fd64cd8809677f0b
MD5 f2d6fbb9476765461a97ad3cc647b316
SHA1 92eb53c470f5af15686574dfec63a0e40bb8ec16
SHA512 ce4d84f75ff08c2d8a4428fc325b376c5d6c0a586ebb52e71d4b6d3cb9fcf63569c7de4966bc890656547579bff9b903780d5813c8d7e53447faaf6ce7448065
SSDEEP 49152:U+Evb6/+EL+EL+Evb6Y+EL+Evb6/+EL+EL+Evb6Y+EL+Evb6/+EL+EL+Evb6Y+E1:9p7L
TLSH
T1ED665C09F69340F1E92BD0B08D9FD37BE7707A2285315E67EF99CA576E33B205918620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 c93a99ec95a5e32a436af55dbfeb493c246f27fff965054dd952b9a8951fe784
MD5 fb69c7cc4ee7ddd6ab26c719c4493d1c
SHA1 d43270fdcfe9bd4b75b0adc103630eedfa776df4
SHA512 c4e66780edd86454a1ea95a57e3be9df2bc5e83e1b93119630207f5c59dc9f022be9563baa9dbee85c60544ab6d9f0914135df95434149af4cb0e55290db7225
TLSH
T1E511A756E1F6A89BE47238CBD6129FC32CE8359F691C6A54130C47197B49C33CE5A8A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1016-0-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/1016-7-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/2328-60-0x00000000055D0000-0x00000000055D1000-memory.dmp

Download

memory/3108-89-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/3492-84-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/4832-39-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/4832-26-0x00000000003E0000-0x0000000000401000-memory.dmp

Download