949ca9886d1284bd3866b6e4cea0a77d614b212367e7b32f3ff617e41442d3c2

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_c3c8e808073a7e5309267634e43a1f9f_elex_stop.exe
Size 582KB
Sample260903-3by91styg1
SHA256 949ca9886d1284bd3866b6e4cea0a77d614b212367e7b32f3ff617e41442d3c2
MD5 c3c8e808073a7e5309267634e43a1f9f
SHA1 185b1fb550506085e561e9a63f5ca59add02011b
SHA512 e14a07d71b235ebf266d9294833aa1fc22e120a8c5f37e07596c076a7278373b1adb88771bb2782bc5462ffd16fd46a04681697149a67604479c5946c283773e
SSDEEP 12288:mgUFgEsnojAQgUFgEsnojAMa0wIk0BX3RKuemGd70ioGuVWW6oIQ:m9+EM0r9+EM0NafDd70iTWCQ
TLSH
T115C47C11FA818031F5B315724AEFE33A4568B9318F258ACFE78C472E5D71AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1576	svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe
3032	svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe
5336	svchost_AACAACAAACBBAACBAACCBBACCCCBBCBCCAABAABCCCAAAABBBBCABAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBCBABBBCBCABACBAABCBCACCABABABCCCCBACCCBBBACAAABABCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe"	2026-09-03_c3c8e808073a7e5309267634e43a1f9f_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBAAABCCCACCBABBCAABCAAABABBAACCBCABCCCBCBBCBABAAACACCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACAACAAACBBAACBAACCBBACCCCBBCBCCAABAABCCCAAAABBBBCABAA.exe"	svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
700	sc.exe
3764	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5136	cmd.exe
2256	cmd.exe
2056	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_c3c8e808073a7e5309267634e43a1f9f_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACAACAAACBBAACBAACCBBACCCCBBCBCCAABAABCCCAAAABBBBCABAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5092	2026-09-03_c3c8e808073a7e5309267634e43a1f9f_elex_stop.exe
5092	2026-09-03_c3c8e808073a7e5309267634e43a1f9f_elex_stop.exe
5092	2026-09-03_c3c8e808073a7e5309267634e43a1f9f_elex_stop.exe
5092	2026-09-03_c3c8e808073a7e5309267634e43a1f9f_elex_stop.exe
1576	svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe
1576	svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe
1576	svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe
1576	svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	2026-09-03_c3c8e808073a7e5309267634e43a1f9f_elex_stop.exe
Token: SeDebugPrivilege	1576	svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 5136	5092	2026-09-03_c3c8e808073a7e5309267634e43a1f9f_elex_stop.exe	93
PID 5136 wrote to memory of 5688	5136	cmd.exe	95
PID 5092 wrote to memory of 2256	5092	2026-09-03_c3c8e808073a7e5309267634e43a1f9f_elex_stop.exe	96
PID 2256 wrote to memory of 700	2256	cmd.exe	98
PID 5092 wrote to memory of 2056	5092	2026-09-03_c3c8e808073a7e5309267634e43a1f9f_elex_stop.exe	99
PID 2056 wrote to memory of 3764	2056	cmd.exe	101
PID 1576 wrote to memory of 4300	1576	svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-03_c3c8e808073a7e5309267634e43a1f9f_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_c3c8e808073a7e5309267634e43a1f9f_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBAABBBABABBACCCBCAABABAAAAABBACAACBCCCBCACAAAABAABBCBACACABCBBBCACBABCACBBCCCACAAACACBBAACBABCBCCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBAABBBABABBACCCBCAABABAAAAABBACAACBCCCBCACAAAABAABBCBACACABCBBBCACBABCACBBCCCACAAACACBBAACBABCBCCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBAAABACBAACACBBCACABCABCCBABBBAABABBBACAACABCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe" start= auto displayName= "UserDataSvc_BCCBAAABACBAACACBBCACABCABCCBABBBAABABBBACAACABCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBAAABACBAACACBBCACABCABCCBABBBAABABBBACAACABCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe" start= auto displayName= "UserDataSvc_BCCBAAABACBAACACBBCACABCABCCBABBBAABABBBACAACABCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBAAABACBAACACBBCACABCABCCBABBBAABABBBACAACABCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBAAABACBAACACBBCACABCABCCBABBBAABABBBACAACABCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3764

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4300

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe
1⤵
- Executes dropped EXE
PID:3032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAAACBBAACBAACCBBACCCCBBCBCCAABAABCCCAAAABBBBCABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAAACBBAACBAACCBBACCCCBBCBCCAABAABCCCAAAABBBBCABAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9092d07eb438c6517a82e644edd7150444a08bed62762beaea57df168d2397f1
MD5 43de7ba6ccf2d4f0d8a759312ba070be
SHA1 99dc51ad19b40cedae75be31ed0b5b78e36f8ce5
SHA512 a5b5726b2d59c2d91fb3d3349921f9104f57e3965fdc3aadf50ce87d915ad63f79359ff7015ce9a844ebbb3155e12517d3a9e7053179662ce8313abe1afdce9a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9dfb850021016324143e073ddd8a582e0122603541845c2312054b068515fd93
MD5 274160a5a2a86a46d27c9958ba08d413
SHA1 0e387c20ae7447dbca93fd573a8f978308f354c4
SHA512 ef0d2c357ae9c9f59bf125a45c496ede559679ad305a062b1900c6b3f191d877b8a0e6a1eccdbcc13e5ce3c3bfcc7e50927a1467ad3253e67718730414f18aa8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6e8b79d4b79347a55fd91258da6e62b108c737903c50749955d90d88c745d5db
MD5 fd970314293a6768f37f5fc831c61a44
SHA1 e66610eaf4a4ea49107a49eb0c9807241841c380
SHA512 13d1f3d20440b881acd287ba60b691a901b324afe519df3effe7c8021396ad00ff4050f5eb271ceb8bfe74375e7831fe56cb2214f23f226202980f817e6c9303
MD5 SHA1 SHA512

Submit Download

UnregisterExpand.exe

Path C:\Users\Admin\Downloads\UnregisterExpand.exe
Size 2.0MB
SHA256 5ad61038e63e802cb2daf7c12d8c5a36704cca755b134ca158abc7c443aa6225
MD5 69ea8ea066c84871dbe65371f5cc4f1a
SHA1 5c5c78b2d81f65cd77e2d647858a2f80d99467b0
SHA512 7a081bd7c497b86cea9091af35856d045b98bb6e9ef0ed714c73397c9b9ad2eff6f18d609c6a6d282fa1f0288b1d0094342b5feb88c51e714538e1f5a0f3630e
SSDEEP 49152:U+E/+EgDd79WCH+E/+EgDd79WCH+E/+EgDd79WCkNB1qwGSQx+i9d:Bp7ap7ap7ONB1qlSQhn
TLSH
T19AA59D11FA818031F5B315724AEFE3794528B9318F298ACFE78C472E5D71AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterExpand.exe

Path C:\Users\Admin\Downloads\UnregisterExpand.exe
Size 3.8MB
SHA256 dd4bd7fe258cea0e7dad09a8793d03ff521a1bb79592ad8d65d5dda12a501146
MD5 6d12142d3c0948bc2a8c6496c99064d8
SHA1 e7afb8e52f5fd954e2c02d004422b68ab068a55f
SHA512 a6694931d5d60f397ca76a22baa7a3f863a9aa721ddee48ee2063205d304ea3c83a6898e6549686354a61d0eb9b45521aaab8a9419cea3d3fd49a439fbe4fb11
SSDEEP 49152:U+E/+EgDd79WCH+E/+EgDd79WCH+E/+EgDd79WCH+E/+EgDd79WCH+E/+EgDd79X:Bp7ap7ap7ap7ap7ap7ONB1qlSQhG
TLSH
T1C0068D11FA818031F5B315724AEFE3794528B9318F298ACFE78C472E5D71AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterExpand.exe

Path C:\Users\Admin\Downloads\UnregisterExpand.exe
Size 4.3MB
SHA256 da2fce3110e1b80fc2458f61bc29c300a5024248b4091d7ac2a0a164a11bd2af
MD5 2ff118201ced05be1b0a1eb274c3be7a
SHA1 5c396b633659c0e6f77896753978c08f75a66b58
SHA512 f4f78295f6a927c68dc5d320436403d7b0da7fdb39e591c6c3dd2f60d57e73ddb1927676efb03d5fd868bff12fe4eb5df33f6eb08ef98ce20bac90de63641b32
SSDEEP 49152:U+E/+EgDd79WCH+E/+EgDd79WCH+E/+EgDd79WCH+E/+EgDd79WCH+E/+EgDd79B:Bp7ap7ap7ap7ap7ap7ap7ONB1qlSQhn
TLSH
T1F9268D11FA818031F5B315724AEFE3394568B9318F298ACFE78C472E5D71AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterExpand.exe

Path C:\Users\Admin\Downloads\UnregisterExpand.exe
Size 4.9MB
SHA256 2e031af9e97232cc2d16716873bf337fc61bdf8a18855e9e91d32004239efb64
MD5 3b59975408b3f398cc902d7ed08fec0b
SHA1 1b1502de1e0328823031721a4d3cacd010025010
SHA512 e41860987411336526943792217b5fe88d4844c35e466dd372e93eb5e075499d39e8420d7fe3ec112687470a8aeafbdf8e5f97b9db9ab324ceaecc681306f4f4
SSDEEP 98304:Bp7ap7ap7ap7ap7ap7ap7ap7ONB1qlSQhd:HYYYYYYYOySsd
TLSH
T11D368D11FA818031F5B315724AEFE3394568B9318F298ACFE78C472E5D71AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ef27fd0510675f5675ec36408be05c0b5782395d234e67a1b3f4df355a777c6c
MD5 2de132270ff7709231d88b58e84b5540
SHA1 68c481b9b7ad36ecc072242eeccc0fe4213eabe7
SHA512 1f56aa751e7b87014f873ad805ec561958a41f9d13798529da8e67fa37b1d2d705782ab8765b27b88b3e8a2c26b15ce053fea3da81540e0c04a2dc6625496460
MD5 SHA1 SHA512

Submit Download

svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABABBABBAABCAACBCBCBBCCCACCCBBCBCBBBBACAAACABBACCACA.exe
Size 582KB
SHA256 949ca9886d1284bd3866b6e4cea0a77d614b212367e7b32f3ff617e41442d3c2
MD5 c3c8e808073a7e5309267634e43a1f9f
SHA1 185b1fb550506085e561e9a63f5ca59add02011b
SHA512 e14a07d71b235ebf266d9294833aa1fc22e120a8c5f37e07596c076a7278373b1adb88771bb2782bc5462ffd16fd46a04681697149a67604479c5946c283773e
SSDEEP 12288:mgUFgEsnojAQgUFgEsnojAMa0wIk0BX3RKuemGd70ioGuVWW6oIQ:m9+EM0r9+EM0NafDd70iTWCQ
TLSH
T115C47C11FA818031F5B315724AEFE33A4568B9318F258ACFE78C472E5D71AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1576-33-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/1576-51-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/1576-72-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/3032-88-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/5092-60-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/5092-34-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/5092-0-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/5092-22-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/5092-11-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/5092-84-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download