c7251e663fd17b4b63a674cf27818b9e66bc5e940f1725c392506684d332660b

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 07:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_08878b23b9832abdff4a7f0bdf0663a1_elex_stop.exe
Size 582KB
Sample260909-jhttbsdl2v
SHA256 c7251e663fd17b4b63a674cf27818b9e66bc5e940f1725c392506684d332660b
MD5 08878b23b9832abdff4a7f0bdf0663a1
SHA1 46b88de56629c910b1be4fc93a18934932d1277c
SHA512 e981754ab3ea815c47d4698e8bffc8bfeb8230566c6be7f72b6a28c883429320cff3fa0872f4d810e28771cf2c469ce30a880990db3e95577023dd48d6d393b4
SSDEEP 12288:mgUFgEsnojAMgUFgEsnojAQa0wIk0BX3RKuemGd70ioGuVWW6oI9:m9+EM0H9+EM0RafDd70iTWC9
TLSH
T1D3C47C10F7828031F57318718AAFD37A5528B9318F298ADFE788473E5D71AE1A934B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
860	svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe
2216	svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BABBBBAAAACBBABCCBABAAABCBBCBBBCBAAAAABBCABACACBBCCCBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe"	2026-09-07_08878b23b9832abdff4a7f0bdf0663a1_elex_stop.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2364	sc.exe
5092	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4844	cmd.exe
2496	cmd.exe
4264	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_08878b23b9832abdff4a7f0bdf0663a1_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4564	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1872	2026-09-07_08878b23b9832abdff4a7f0bdf0663a1_elex_stop.exe
1872	2026-09-07_08878b23b9832abdff4a7f0bdf0663a1_elex_stop.exe
1872	2026-09-07_08878b23b9832abdff4a7f0bdf0663a1_elex_stop.exe
1872	2026-09-07_08878b23b9832abdff4a7f0bdf0663a1_elex_stop.exe
860	svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe
860	svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe
860	svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe
860	svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1872	2026-09-07_08878b23b9832abdff4a7f0bdf0663a1_elex_stop.exe
Token: SeDebugPrivilege	860	svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
864	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 4844	1872	2026-09-07_08878b23b9832abdff4a7f0bdf0663a1_elex_stop.exe	102
PID 4844 wrote to memory of 4564	4844	cmd.exe	104
PID 1872 wrote to memory of 2496	1872	2026-09-07_08878b23b9832abdff4a7f0bdf0663a1_elex_stop.exe	105
PID 2496 wrote to memory of 2364	2496	cmd.exe	107
PID 1872 wrote to memory of 4264	1872	2026-09-07_08878b23b9832abdff4a7f0bdf0663a1_elex_stop.exe	108
PID 4264 wrote to memory of 5092	4264	cmd.exe	110
PID 860 wrote to memory of 4200	860	svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe	112
PID 4200 wrote to memory of 1472	4200	notepad.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-09-07_08878b23b9832abdff4a7f0bdf0663a1_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_08878b23b9832abdff4a7f0bdf0663a1_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACBCBBBAABCCACABBCCABBBAAAAABCBCBBCACCCBBBBCCAACABAABCBCBBCBCCCCBACBCABAABBBCCCABCBCBCCCBACBCAABBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACBCBBBAABCCACABBCCABBBAAAAABCBCBBCACCCBBBBCCAACABAABCBCBBCBCCCCBACBCABAABBBCCCABCBCBCCCBACBCAABBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCBBCCCCCABBACCBCACCBBAACCACCBACBCABAAABCBAABCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe" start= auto displayName= "UserDataSvc_BCBCBBCCCCCABBACCBCACCBBAACCACCBACBCABAAABCBAABCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCBBCCCCCABBACCBCACCBBAACCACCBACBCABAAABCBAABCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe" start= auto displayName= "UserDataSvc_BCBCBBCCCCCABBACCBCACCBBAACCACCBACBCABAAABCBAABCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCBBCCCCCABBACCBCACCBBAACCACCBACBCABAAABCBAABCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCBBCCCCCABBACCBCACCBBAACCACCBACBCABAAABCBAABCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe
1⤵
- Executes dropped EXE
PID:2216

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6212165a98ac8a2737f9c3f133b4ae37a32b381b744ab05584d89079305b643a
MD5 0f28a0a64b88ebdeacf742d38a588d62
SHA1 72330f3831a7741f07247e97cea19105da0a42f3
SHA512 6fdd5474b421ff7133448d2dbdef334cabeb0269f75c37d7cd194fa98b85a0cdcf103b87d2c3d645e2664da849784898acbbfea5bb084f09523d45c507b14a42
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41febdc86fc993e8c5c51a699e669585ee25535db8f9038287a831361b17cc21
MD5 b22757759291867be57294e39114be45
SHA1 37f0c706568e46db286a05644b52dece323e9caf
SHA512 fad72db5f9a55c3bf35051d42934f81fa7b0c5805434baa96fa82f508ce8765cb4bcea565f7ed78a33b2d94be414aaa53e2d933c2f7fe1b6b2661f662adcba1e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 30d6791083f5ae17c56158dd39bab9aa3e925a83423be16f2a4153a9cd157298
MD5 8a8b0575d3b8a08966d449543b6a5ce2
SHA1 3ba9b64aa47775d55016038fcd5bf0a13efd74be
SHA512 d7513ce06d6f8e46a2b3681a2942373005e1822ccb7a10bf9f2f58738e49df0fa600f96ac79249229509486f75ea526bbd73908dd61d35b2408bbef68a460938
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a841fab9534948a95b757e180940ccfa91aecf511d3d053195a2602fb0f5abd2
MD5 f8e5eadd8b7d7fac6884c54f342bc511
SHA1 c389073292a12056b14301cf83e1679ac2f5d83f
SHA512 e7c8889da5b5b2c8644d1d3414992067133411ed7d852aa40513be6a0d6b9eae66384fb4a49749b496f8220cf19c0206d6f93d13d34885f57aa09b1e09511355
MD5 SHA1 SHA512

Submit Download

svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACAABACBABAACACACCCCCCBBBBCBCCCACBBCABCABBCCACACAACB.exe
Size 582KB
SHA256 c7251e663fd17b4b63a674cf27818b9e66bc5e940f1725c392506684d332660b
MD5 08878b23b9832abdff4a7f0bdf0663a1
SHA1 46b88de56629c910b1be4fc93a18934932d1277c
SHA512 e981754ab3ea815c47d4698e8bffc8bfeb8230566c6be7f72b6a28c883429320cff3fa0872f4d810e28771cf2c469ce30a880990db3e95577023dd48d6d393b4
SSDEEP 12288:mgUFgEsnojAMgUFgEsnojAQa0wIk0BX3RKuemGd70ioGuVWW6oI9:m9+EM0H9+EM0RafDd70iTWC9
TLSH
T1D3C47C10F7828031F57318718AAFD37A5528B9318F298ADFE788473E5D71AE1A934B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/860-27-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/860-40-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1872-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1872-8-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4200-68-0x0000000002570000-0x0000000002571000-memory.dmp

Download