6cbd6bb7526fa9d08c83641371bfca06a00353f1a1d23b8e03fc177af1b98e6d

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_16b6d95b146b12bda369f082cd660371_elex_stop.exe
Size 2.8MB
Sample260905-waxapsfq3x
SHA256 6cbd6bb7526fa9d08c83641371bfca06a00353f1a1d23b8e03fc177af1b98e6d
MD5 16b6d95b146b12bda369f082cd660371
SHA1 4984c63c8c9f66cccf29e6935d26e147177dab0b
SHA512 628770857551ec24a57f6dd28a08902fa9be7cfed5b5b5c49c80f42a1bf00079045b07e7f9bf319c599f56b92e32829743814c94bbdf1cee4d8c5f184d37cd79
SSDEEP 49152:U+EYDd79WCn+En+EYDd79WCn+En+EYDd79WCn+En+EYDd79WCn+En+EYDd79WCs3:jp7ep7ep7ep7ep7a
TLSH
T1B3D57C10B6818035F5B325718ABFE3399538B9314F258ACFE788472E5E71BE1A934727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3000	svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe
2528	svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe
4516	svchost_ACBAABACBBCBBBCCBCBABCCCBBCCCABCCCBCBBBBABCBCACABAACACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACABBACCBCACBCBCBACAAACBCBBBCBCAACCABABABBBBAAACACABCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBAABACBBCBBBCCBCBABCCCBBCCCABCCCBCBBBBABCBCACABAACACA.exe"	svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAABBCBBBBAACCCBBCABCAABCBABCBCBBABAAABAABABABCAAABAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe"	2026-09-04_16b6d95b146b12bda369f082cd660371_elex_stop.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1692	sc.exe
1388	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3904	cmd.exe
2120	cmd.exe
3580	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBAABACBBCBBBCCBCBABCCCBBCCCABCCCBCBBBBABCBCACABAACACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_16b6d95b146b12bda369f082cd660371_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3452	2026-09-04_16b6d95b146b12bda369f082cd660371_elex_stop.exe
3452	2026-09-04_16b6d95b146b12bda369f082cd660371_elex_stop.exe
3452	2026-09-04_16b6d95b146b12bda369f082cd660371_elex_stop.exe
3452	2026-09-04_16b6d95b146b12bda369f082cd660371_elex_stop.exe
3000	svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe
3000	svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe
3000	svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe
3000	svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	2026-09-04_16b6d95b146b12bda369f082cd660371_elex_stop.exe
Token: SeDebugPrivilege	3000	svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 3904	3452	2026-09-04_16b6d95b146b12bda369f082cd660371_elex_stop.exe	92
PID 3904 wrote to memory of 1828	3904	cmd.exe	94
PID 3000 wrote to memory of 5904	3000	svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe	95
PID 3452 wrote to memory of 2120	3452	2026-09-04_16b6d95b146b12bda369f082cd660371_elex_stop.exe	96
PID 2120 wrote to memory of 1692	2120	cmd.exe	98
PID 3452 wrote to memory of 3580	3452	2026-09-04_16b6d95b146b12bda369f082cd660371_elex_stop.exe	99
PID 3580 wrote to memory of 1388	3580	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-04_16b6d95b146b12bda369f082cd660371_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_16b6d95b146b12bda369f082cd660371_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBACCAAAABCBCCBBCBBCACACABACBCCAACCAAAAAABABBBBCCBBCBCCABBBCACAAACCCACCCBACBAABACACCCABABABBCCBAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBACCAAAABCBCCBBCBBCACACABACBCCAACCAAAAAABABBBBCCBBCBCCABBBCACAAACCCACCCBACBAABACACCCABABABBCCBAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCACCABAACCAACBAAAACAACABCABACCAABBACBACBABCABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe" start= auto displayName= "UserDataSvc_CCCCACCABAACCAACBAAAACAACABCABACCAABBACBACBABCABBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCACCABAACCAACBAAAACAACABCABACCAABBACBACBABCABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe" start= auto displayName= "UserDataSvc_CCCCACCABAACCAACBAAAACAACABCABACCAABBACBACBABCABBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCACCABAACCAACBAAAACAACABCABACCAABBACBACBABCABBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCACCABAACCAACBAAAACAACABCABACCAABBACBACBABCABBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1388

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5904

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe
1⤵
- Executes dropped EXE
PID:2528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABACBBCBBBCCBCBABCCCBBCCCABCCCBCBBBBABCBCACABAACACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABACBBCBBBCCBCBABCCCBBCCCABCCCBCBBBBABCBCACABAACACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7ab873fe2f6d5c67b9cef943024af9da8006382e3fc5a922eeb84db53cc265ed
MD5 d28cc0e08db243326781ff592ce2f431
SHA1 ab7df63a7ac7864660c702a159b9cc67e2c69146
SHA512 b43b060772700ab0309da4504edc500f8f1a945561d3dbc809d1dbfda1c8e9996c1e61d799aac571d42687ef316c41952b5350d1fd8eeb13b5d2bd09cb209de4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f9f6dead62bd851fa431ac6aa79390f6263d8a62da1007f38bdd5982e08a77ab
MD5 790842bc05cb5cb29e629611cfa53951
SHA1 e80402ff0ed008014b7dfc56e9ff7aeb22737734
SHA512 2cfc8e52701b3b15cf6800c4569bdd418923c909262545678e1ce3da06009bab184f0d1c44f5ca8b84fbd4aade10e3c637f681da2fdc20b151d9bf22de77a80b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 795a93e8a10bc74128e0e3c2988a3836e6f48c58473bc1b601971404db8d2f7d
MD5 9190d8e6aefc48bffb4d38dc3542a361
SHA1 9f6cfe3d4eadc1cb61d3613bdea8c2bdc688b888
SHA512 4d8da10531b166f61f4bd118210e0eaf53386107c88286c541c99d46f8c6456102a7f6668e04947d715d0b75f46d4c11c18d95deadf312e8d6092198e288a1bc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7ce6eb80e8f594950368ec0433f840e416d3ad0a763b19e0e49e35ebda394a24
MD5 7fd39c7c79fd3568991369f2509d01e4
SHA1 cacabffcf319fd051e0a95db304f0b7932001ada
SHA512 ada0d83d0b136eb0664fbdd32d826fd1c106bd3220e6dcd640939b45e3c6e8802e9b50183642286203686d21da4c96d01d79648d204a8f385267dfc3538d405d
MD5 SHA1 SHA512

Submit Download

svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBBAABCCBABCCBBBBACBABAAACAABBCCCACCBBAACCBCCBBA.exe
Size 2.8MB
SHA256 6cbd6bb7526fa9d08c83641371bfca06a00353f1a1d23b8e03fc177af1b98e6d
MD5 16b6d95b146b12bda369f082cd660371
SHA1 4984c63c8c9f66cccf29e6935d26e147177dab0b
SHA512 628770857551ec24a57f6dd28a08902fa9be7cfed5b5b5c49c80f42a1bf00079045b07e7f9bf319c599f56b92e32829743814c94bbdf1cee4d8c5f184d37cd79
SSDEEP 49152:U+EYDd79WCn+En+EYDd79WCn+En+EYDd79WCn+En+EYDd79WCn+En+EYDd79WCs3:jp7ep7ep7ep7ep7a
TLSH
T1B3D57C10B6818035F5B325718ABFE3399538B9314F258ACFE788472E5E71BE1A934727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3000-24-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3000-37-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3452-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3452-8-0x0000000000400000-0x0000000000421000-memory.dmp

Download