a8aa0bb0af3975ac04fa60d591a61e52af9df829b35ec928ea2236c37a90ffb3

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_7ea55c75a7710a0d341fe2a18d12005f_elex_stop.exe
Size 582KB
Sample260907-s3tthack7t
SHA256 a8aa0bb0af3975ac04fa60d591a61e52af9df829b35ec928ea2236c37a90ffb3
MD5 7ea55c75a7710a0d341fe2a18d12005f
SHA1 73b3d9adf9381d2f42fc0d02f4216a40e28e8612
SHA512 863226f6cc6651e496965d369c3af542c83a6e6ad246150c7b1da764a0d15f5fa46ae17d563a9b5311ea36c8eb4d6d63d161abdb538ed16f713ca4e895b50398
SSDEEP 12288:mgUFgEsnojAKgUFgEsnojAaa0wIk0BX3RKuemGd70ioGuVWW6oIg:m9+EM0V9+EM0bafDd70iTWCg
TLSH
T188C48D01F6818031F5B315724AAFD33A9568B9318F298ACFE78C472E5D71BE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1856	svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe
4720	svchost_BBABBCBCBACCBAACACACBBACBBBAABABCCACCBBBBBCBACBCAAAAACB.exe
4172	svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCBBBBCCACCCACBBCBCAACACAACBBBACCCCCBCBCCBAACBCBACBBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe"	2026-09-05_7ea55c75a7710a0d341fe2a18d12005f_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBCACBBACACAACCBBAABAAAABACBBBBCCBBBACBACBCABCBBCBAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABBCBCBACCBAACACACBBACBBBAABABCCACCBBBBBCBACBCAAAAACB.exe"	svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2092	sc.exe
5796	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4132	cmd.exe
4224	cmd.exe
2940	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_7ea55c75a7710a0d341fe2a18d12005f_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABBCBCBACCBAACACACBBACBBBAABABCCACCBBBBBCBACBCAAAAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2508	2026-09-05_7ea55c75a7710a0d341fe2a18d12005f_elex_stop.exe
2508	2026-09-05_7ea55c75a7710a0d341fe2a18d12005f_elex_stop.exe
2508	2026-09-05_7ea55c75a7710a0d341fe2a18d12005f_elex_stop.exe
2508	2026-09-05_7ea55c75a7710a0d341fe2a18d12005f_elex_stop.exe
1856	svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe
1856	svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe
1856	svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe
1856	svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe
4720	svchost_BBABBCBCBACCBAACACACBBACBBBAABABCCACCBBBBBCBACBCAAAAACB.exe
4720	svchost_BBABBCBCBACCBAACACACBBACBBBAABABCCACCBBBBBCBACBCAAAAACB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	2026-09-05_7ea55c75a7710a0d341fe2a18d12005f_elex_stop.exe
Token: SeDebugPrivilege	1856	svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe
Token: SeDebugPrivilege	4720	svchost_BBABBCBCBACCBAACACACBBACBBBAABABCCACCBBBBBCBACBCAAAAACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 4132	2508	2026-09-05_7ea55c75a7710a0d341fe2a18d12005f_elex_stop.exe	91
PID 4132 wrote to memory of 4772	4132	cmd.exe	93
PID 1856 wrote to memory of 3764	1856	svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe	94
PID 2508 wrote to memory of 4224	2508	2026-09-05_7ea55c75a7710a0d341fe2a18d12005f_elex_stop.exe	97
PID 4224 wrote to memory of 5796	4224	cmd.exe	99
PID 2508 wrote to memory of 2940	2508	2026-09-05_7ea55c75a7710a0d341fe2a18d12005f_elex_stop.exe	100
PID 2940 wrote to memory of 2092	2940	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-05_7ea55c75a7710a0d341fe2a18d12005f_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_7ea55c75a7710a0d341fe2a18d12005f_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBCCCCBCCBABAABACCCCACCABAACCBCBBABCACAACBBBCCBACAABBBBAAACCCAAAAAAAACACBBCCBAAABBCBCAAACBBCBACCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBCCCCBCCBABAABACCCCACCABAACCBCBBABCACAACBBBCCBACAABBBBAAACCCAAAAAAAACACBBCCBAAABBCBCAAACBBCBACCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBCCBBCAAAACCCCCBCABCCBAACBAABACBABBBACCABABCBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe" start= auto displayName= "UserDataSvc_ABBBCCBBCAAAACCCCCBCABCCBAACBAABACBABBBACCABABCBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBCCBBCAAAACCCCCBCABCCBAACBAABACBABBBACCABABCBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe" start= auto displayName= "UserDataSvc_ABBBCCBBCAAAACCCCCBCABCCBAACBAABACBABBBACCABABCBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBCCBBCAAAACCCCCBCABCCBAACBAABACBABBBACCABABCBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBCCBBCAAAACCCCCBCABCCBAACBAABACBABBBACCABABCBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3764

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBCBACCBAACACACBBACBBBAABABCCACCBBBBBCBACBCAAAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBCBACCBAACACACBBACBBBAABABCCACCBBBBBCBACBCAAAAACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe
1⤵
- Executes dropped EXE
PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 12386ed65c1c75d3365ec1f13af3b4687f1f08b2075f57bb59b062ce4936d3e3
MD5 07e22851c4fef0af36c5628bab64de08
SHA1 3feee89297610cf3a5e26a8f896508000ec7af3c
SHA512 49f9a744207a83a55e8e8a259803e877c31080d40bb08f32f03b512504d758d86bf06579ecc7bab325e774e9850a67a61083081b196cf2067fffdc59aa52eaeb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c52c93779b71b593f147e02590abf237d77258023f9b89dde1f9cce09ff84c10
MD5 6edcbf395f724652debbb238cb494967
SHA1 baaed82533a31cb193c4ae05c91b6a5bc86a3a33
SHA512 e5a1fb5527522753f188a277f5412185ede2f7f66fa848f169800d3ac0499d6b26e753f25200913d9c430d8cfcb159835b88f2632b1f52d878c78f9c15dffeca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0d311cf7822e3029e6a1a535b9a482a5565c759c350f6fa6a1522b55cd8de80d
MD5 e66b15b2bb3e68605d082e0fa70b672e
SHA1 d1a189cd02c1a65f9e44bd6e4557b734a98dc572
SHA512 4f29b49c64833c52f43ff78e1ae4596385c45634dfd156d71f72d3493a6acd7326e06cb0335be05f359affd7a537ed99ea7823bc4b50dcc2099b08b58e6232f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9f1c5f8758ffd24974bf7ce6cf199c8a948ebc7f46d0d954a9900508acf0ba62
MD5 ef4e6cde963e0a314ac07207ca1fcb42
SHA1 e24cc41ebfa030080682c9fcf567931bd382beb6
SHA512 90936113135df842a0f109ec36072564537c110ce397a3a4c9133b66f92c242e4780c1fe8683eee2eeca389af302d0a558f27232b1a1bd2984d001b53cae8408
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 27be0788354bfc7ca2f52b83115623dbd4fa958971c89c438319a5b07adc1dd6
MD5 3ce3bc32621ddf76cc2bd2d4201d525a
SHA1 3db1636de8e46fd77d7a3734f1c7da49208865a7
SHA512 deaccd67c0912f03e0bf48d9c633d5ae748efe5cecaf620c4efa39035689f3ad7d6cf6193fafea92347c52093b64e3069336f67f7d62ce35b219646ebeb2f055
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1e2c02e46928a9bff167afdb3e6bacf960a48734b105818d1ede75f6b3071f73
MD5 a32db1d7e750be8e55054321dbea1502
SHA1 08663038ac80807b9424d2ffa2ea110683aa37c1
SHA512 2f6346e0a774e139130340b5b43c538909c8e62e6a56ed5cc0e428b033b87ac06d2c1fcc1e8c58c9878ea6845d4570e5d68789af4d8b75dae6cd5980f1f90416
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9cb30f622dabef1a657088d8f6eb6069789c8aed4f978c255aee772a74ccb0ae
MD5 94fbfbed3855fa32be556dae6ae4b42d
SHA1 223165c775cd1e20422911178a9054acaddce319
SHA512 e90c8f7eaf3e17b8f3838481a87167f70d3dfd1c7ba000be9194224dfef278fbe9dbf017d3bd3280b920a023da2d461c08914c8dbaf59caa45b7622f7bb839f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0829e4480e003bb0983e6abb9e8a60aba82dbdc1dd045759f6934b14eb79e2ec
MD5 1100fe25cabe937abeab8f1545e6366e
SHA1 7a5c5ddf2cacba643c16c50ff5f71b1fdb196f44
SHA512 02ec82fcded308f15f93518d837ecdee36a3260fbd0081bc21bbef37399de0041f14dc4c17d2e1054fff7ee6828a4c1b493ec2f6ee2f63bc8cb3ae12f57f85c9
MD5 SHA1 SHA512

Submit Download

svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAACACCACCABCBBCCCCACACBAAABCCCBAAABAAABACCCCACCBAC.exe
Size 582KB
SHA256 a8aa0bb0af3975ac04fa60d591a61e52af9df829b35ec928ea2236c37a90ffb3
MD5 7ea55c75a7710a0d341fe2a18d12005f
SHA1 73b3d9adf9381d2f42fc0d02f4216a40e28e8612
SHA512 863226f6cc6651e496965d369c3af542c83a6e6ad246150c7b1da764a0d15f5fa46ae17d563a9b5311ea36c8eb4d6d63d161abdb538ed16f713ca4e895b50398
SSDEEP 12288:mgUFgEsnojAKgUFgEsnojAaa0wIk0BX3RKuemGd70ioGuVWW6oIg:m9+EM0V9+EM0bafDd70iTWCg
TLSH
T188C48D01F6818031F5B315724AAFD33A9568B9318F298ACFE78C472E5D71BE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2d45c8bd5966e1a5759e85f01492c14934377956d64787a379ac916b0f6d57fc
MD5 caa1320c4996ca1acf4cdb2749efa746
SHA1 75c92409c82ebb2d11bb358ecdb97b7138e5e4f2
SHA512 a66b970a3662db381516bf86f618bb01e7e570dd49e544177cecbeebcb20b72323f70bd03696f8dc9c898fb1143ad0e3b5669e212dc1fb59931c6183cff838ae
TLSH
T16F112B11F0EA98A7E13234D75A19CFC70C953B9F591CAB58230C161CB75EC368D564E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1856-33-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2508-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2508-7-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4172-84-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4720-64-0x0000000000400000-0x0000000000421000-memory.dmp

Download