3ca2b31233e4a3851477f5b164df39bc95b8d817e820bec7847125c411080c3d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_85a3395431be18f866a8784b9b10f200_elex_stop.exe
Size 582KB
Sample260907-rs73pshd64
SHA256 3ca2b31233e4a3851477f5b164df39bc95b8d817e820bec7847125c411080c3d
MD5 85a3395431be18f866a8784b9b10f200
SHA1 975d36a66529a73ec6ea4a1acda213fb10eff068
SHA512 0c228934fba957f725d4bd54d0cee619632ebb77dfa64a37181b50e2da9f3335ac73a5bb5062a171357912aa3673490cb838bd5efb19a695b0103259e9070ab8
SSDEEP 12288:mgUFgEsnojAhgUFgEsnojAfa0wIk0BX3RKuemGd70ioGuVWW6oIg:m9+EM0e9+EM0WafDd70iTWCg
TLSH
T16FC48D11F6818031F5B318724AEFE37A4528BA314F658ACFE78C472E6D71AE1A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
616	svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe
3172	svchost_CAAABACABABABABACCACBBAABCBCCBCBACCBBBBCCBABCBBCBCBCABC.exe
5608	svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACBCCAAACAACAABBAABACBAACBAACACBCACCBBBACABBCBBCAABCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe"	2026-09-05_85a3395431be18f866a8784b9b10f200_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBCABAABBCBABABABBCACBCCCBAACCCCACCCAACBCABACCACCCBAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAABACABABABABACCACBBAABCBCCBCBACCBBBBCCBABCBBCBCBCABC.exe"	svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4320	sc.exe
5216	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3364	cmd.exe
1524	cmd.exe
4236	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_85a3395431be18f866a8784b9b10f200_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAABACABABABABACCACBBAABCBCCBCBACCBBBBCCBABCBBCBCBCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5112	2026-09-05_85a3395431be18f866a8784b9b10f200_elex_stop.exe
5112	2026-09-05_85a3395431be18f866a8784b9b10f200_elex_stop.exe
5112	2026-09-05_85a3395431be18f866a8784b9b10f200_elex_stop.exe
5112	2026-09-05_85a3395431be18f866a8784b9b10f200_elex_stop.exe
616	svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe
616	svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe
616	svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe
616	svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe
3172	svchost_CAAABACABABABABACCACBBAABCBCCBCBACCBBBBCCBABCBBCBCBCABC.exe
3172	svchost_CAAABACABABABABACCACBBAABCBCCBCBACCBBBBCCBABCBBCBCBCABC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	2026-09-05_85a3395431be18f866a8784b9b10f200_elex_stop.exe
Token: SeDebugPrivilege	616	svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe
Token: SeDebugPrivilege	3172	svchost_CAAABACABABABABACCACBBAABCBCCBCBACCBBBBCCBABCBBCBCBCABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 1524	5112	2026-09-05_85a3395431be18f866a8784b9b10f200_elex_stop.exe	92
PID 1524 wrote to memory of 4988	1524	cmd.exe	94
PID 616 wrote to memory of 3408	616	svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe	95
PID 5112 wrote to memory of 4236	5112	2026-09-05_85a3395431be18f866a8784b9b10f200_elex_stop.exe	98
PID 4236 wrote to memory of 4320	4236	cmd.exe	100
PID 5112 wrote to memory of 3364	5112	2026-09-05_85a3395431be18f866a8784b9b10f200_elex_stop.exe	101
PID 3364 wrote to memory of 5216	3364	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-05_85a3395431be18f866a8784b9b10f200_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_85a3395431be18f866a8784b9b10f200_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCACBCACBAAAAACABCBACAABACBBABCABCAABACBACAABABAABAACACCBBAABABCBACACCCAABCBBBACBABBACBBACBCBBABCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCACBCACBAAAAACABCBACAABACBBABCABCAABACBACAABABAABAACACCBBAABABCBACACCCAABCBBBACBABBACBBACBCBBABCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCCBCAABACCABBACABCCACBBCCACCBACCABABCCABCBABBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe" start= auto displayName= "UserDataSvc_ABBCCBCAABACCABBACABCCACBBCCACCBACCABABCCABCBABBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBCCBCAABACCABBACABCCACBBCCACCBACCABABCCABCBABBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe" start= auto displayName= "UserDataSvc_ABBCCBCAABACCABBACABCCACBBCCACCBACCABABCCABCBABBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCCBCAABACCABBACABCCACBBCCACCBACCABABCCABCBABBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBCCBCAABACCABBACABCCACBBCCACCBACCABABCCABCBABBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACABABABABACCACBBAABCBCCBCBACCBBBBCCBABCBBCBCBCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACABABABABACCACBBAABCBCCBCBACCBBBBCCBABCBBCBCBCABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe
1⤵
- Executes dropped EXE
PID:5608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2faaf3fe9059d49fe8920b184f8073c9c845a65305be480836cd78b4412f8f25
MD5 eeb9dfbf7b4a38cb58105607b3aa68e5
SHA1 b24748989711a64efee3208665e46aa12ec3c501
SHA512 b09c51ac83a2676cfaebdf600b8bddd55ab524235cf34dedc367b38a8451f2be2bda7c4fd670c9f8e1f70036bc90afba25ebd109e61149ae5c5f8131f6f6519e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 74f521c50ba4456d4a75a5166bf53619bdcf73a1a595d69d6a68f1b3be46e587
MD5 d7d02b3761686eb996e79d96710954af
SHA1 09b1468d7aba64822ac6e8a68bab5761fe0bc0b8
SHA512 12dbe75bff471242b075f45f28008f0fda0392cccde8de4a71e1079743fb211da77cd76be603de74d76f82f6bc57e32e0bf5f3f74f9ccca8d033b4dc03093a95
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fcbbfb96c8827c836c216c994efc8e455409b384e6ec7466ddf04cf2407c334f
MD5 16847c76d7b4f6646458409a565dfcef
SHA1 713ec259e6b7eb5a7c7121edc6e615d0818a32f5
SHA512 15c29c13cc921f5b19219a71ad0d11b4d2b262882edd85c2e96a09af94d8dd23cb24375ba3d6f5fc738e1ec638c9e40daa11c18c0a6ebb6c2e9f3a7f3781f21e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 71d431d7e1cec1338e69db20878d27088895378ac0017a7689e731153d4fa843
MD5 504b950330dddf7eded0e8c7a595eb75
SHA1 d0f5bf3fc40687a920dba9e176cad7b63525248d
SHA512 26edeb9c426d8b72fa7d42732752b3869d01495290d4a99bfc3b0dc1074e372d450643d672e2c99e06846d453a384b224584672e169220991921fd6721cbc2e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8bf4332e39ae52da162f5c31a95beedacff01178f05c3ffccd6460ab7f875422
MD5 2407398d9a13f463753b0ac121eb1448
SHA1 736d87e514cfe7f0930be4df575e63a172f3e1a8
SHA512 1d8596c8d0fe81fef70d08260be402d93156936b43ee4f862e5a545f2ee68cc9651143bd7366f01eda3278b3addf4b48d7d387111bcfabdb449cef11e90901b8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a22454beca99635cee16b25e9ae3b233d3b92a82523a6c908b2cc66af99cee09
MD5 a37a1b569dad44469fb106a8525cbb1c
SHA1 067e390c0e5fcd9e78d23439bb618a0bd78fe735
SHA512 a3bc95787bbd44d9af76ba172762f0873e6fca22923554e6b4b1fd6717f035aae7f6bac50ca8f7bd9b1699d5697716287e8c0f27b29e0671b9d0ad7f39cf9b07
MD5 SHA1 SHA512

Submit Download

svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACAABAABAACCCBCBACBBBBCBACCBCCCBCACBCACBCABCCBACCC.exe
Size 582KB
SHA256 3ca2b31233e4a3851477f5b164df39bc95b8d817e820bec7847125c411080c3d
MD5 85a3395431be18f866a8784b9b10f200
SHA1 975d36a66529a73ec6ea4a1acda213fb10eff068
SHA512 0c228934fba957f725d4bd54d0cee619632ebb77dfa64a37181b50e2da9f3335ac73a5bb5062a171357912aa3673490cb838bd5efb19a695b0103259e9070ab8
SSDEEP 12288:mgUFgEsnojAhgUFgEsnojAfa0wIk0BX3RKuemGd70ioGuVWW6oIg:m9+EM0e9+EM0WafDd70iTWCg
TLSH
T16FC48D11F6818031F5B318724AEFE37A4528BA314F658ACFE78C472E6D71AE1A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 ac4d4b40fecee681c2479533621fae5d4c3ff2b91471de55ab4bfb445fc3802a
MD5 f89deac910b8e27b0c5143ca88f389e9
SHA1 db5275106ff94af2f89ee15cf1b33a7544d8c4dc
SHA512 e4704b672e7ec431ab4fa37230623465c7b70870ccf0cc610a4fc5f8905a82429b4292c06d93cd1a97cb4a16792ad3b7efe608f93c5319c8d36102863139c616
TLSH
T1F211E75170A5D873E4B134D7D51ACED708E43F9BAE58EB18120D821DB79AC3ACE514D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/616-23-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/616-33-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/3172-79-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/5112-0-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/5112-7-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download