5bd7dc247370020998200508fbfa5b4ba497003a601157b809851ee38a0f72b5

Analysis

max time kernel
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_d1fdb708581139d3663c91c2417f425c_coinminer_elex_hijackloader_icedid_njrat.exe
Size 13.3MB
Sample260910-c2bnjadk2y
SHA256 5bd7dc247370020998200508fbfa5b4ba497003a601157b809851ee38a0f72b5
MD5 d1fdb708581139d3663c91c2417f425c
SHA1 e0f1938fe0244e862900ffced56a8254cf95ece2
SHA512 669676df6edf656fe8039b46c9c650d2c38971524dff46936f86c5785411616efd50ce62d224fafabe624e4ad97f6e80a400bd29d6a034f6102544e656c12e51
SSDEEP 49152:U+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Epe+ES+Ey+ES+Et+ES+n:5PPPPPPPPvn7Oi
TLSH
T1D2E64C09F94344F1D92B51B04DCFD2BF8A70BB2586128EFBF74DCB1B6923B616828255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x001100000001c50b-27.dat	UPX
behavioral2/files/0x000d00000001bceb-35.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
3428	svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe
4804	svchost_ACBCCBCCABCCCACCCCAACBCABCCACBACCABABCCCCAACACACCBAAACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAAAACACCAAACBBBBBABABCCBCBBCBCCBAAABCCBABAAAACCBABAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe"	2026-09-08_d1fdb708581139d3663c91c2417f425c_coinminer_elex_hijackloader_icedid_njrat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACCACBBABBBBBABAACBAABBACCCAAABACBABCCCAAACBBBBACBCCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCCBCCABCCCACCCCAACBCABCCACBACCABABCCCCAACACACCBAAACA.exe"	svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5076	sc.exe
2288	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6080	cmd.exe
3208	cmd.exe
2716	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCCBCCABCCCACCCCAACBCABCCACBACCABABCCCCAACACACCBAAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_d1fdb708581139d3663c91c2417f425c_coinminer_elex_hijackloader_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4188	2026-09-08_d1fdb708581139d3663c91c2417f425c_coinminer_elex_hijackloader_icedid_njrat.exe
4188	2026-09-08_d1fdb708581139d3663c91c2417f425c_coinminer_elex_hijackloader_icedid_njrat.exe
4188	2026-09-08_d1fdb708581139d3663c91c2417f425c_coinminer_elex_hijackloader_icedid_njrat.exe
4188	2026-09-08_d1fdb708581139d3663c91c2417f425c_coinminer_elex_hijackloader_icedid_njrat.exe
3428	svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe
3428	svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe
3428	svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe
3428	svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4188	2026-09-08_d1fdb708581139d3663c91c2417f425c_coinminer_elex_hijackloader_icedid_njrat.exe
Token: SeDebugPrivilege	3428	svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 6080	4188	2026-09-08_d1fdb708581139d3663c91c2417f425c_coinminer_elex_hijackloader_icedid_njrat.exe	91
PID 6080 wrote to memory of 3372	6080	cmd.exe	93
PID 3428 wrote to memory of 3436	3428	svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe	94
PID 4188 wrote to memory of 3208	4188	2026-09-08_d1fdb708581139d3663c91c2417f425c_coinminer_elex_hijackloader_icedid_njrat.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-09-08_d1fdb708581139d3663c91c2417f425c_coinminer_elex_hijackloader_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_d1fdb708581139d3663c91c2417f425c_coinminer_elex_hijackloader_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBCBABBBBBBCACAACABAACCABABBCBCBBABACBABBACCAABAABBBCBBBCCCCCBBBBBBCCABBCCACABBCBAACCCCCBBBCBBBCBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBCBABBBBBBCACAACABAACCABABBCBCBBABACBABBACCAABAABBBCBBBCCCCCBBBBBBCCABBCCACABBCBAACCCCCBBBCBBBCBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBAACBAAABAAACAABBBAABBCBCAACCABCBABABAAACCACBCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe" start= auto displayName= "UserDataSvc_ACBAACBAAABAAACAABBBAABBCBCAACCABCBABABAAACCACBCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3208
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBAACBAAABAAACAABBBAABBCBCAACCABCBABABAAACCACBCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe" start= auto displayName= "UserDataSvc_ACBAACBAAABAAACAABBBAABBCBCAACCABCBABABAAACCACBCABC"
    3⤵
    - Launches sc.exe
    PID:5076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBAACBAAABAAACAABBBAABBCBCAACCABCBABABAAACCACBCABC"
  2⤵
  - Executes a command shell one-liner
  PID:2716
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBAACBAAABAAACAABBBAABBCBCAACCABCBABABAAACCACBCABC"
    3⤵
    - Launches sc.exe
    PID:2288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCBCCABCCCACCCCAACBCABCCACBACCABABCCCCAACACACCBAAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCBCCABCCCACCCCAACBCABCCACBACCABABCCCCAACACACCBAAACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe
1⤵
PID:2352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c3ad2c0b8b0939aeae23f78de689dbf325a2d812149cfd98d961ea154b96d7b5
MD5 4d73fa2bcdfd8b288768538618a736a0
SHA1 67f75f64ddafa68f6238db32865b86d241e016f5
SHA512 3a06701e420be46f63c05df176a885aab8f7548bcfdd4724e4a9d448ca46c4cbfc2c92868ea75cdf3eace901683d9a795a25de66d3ec89e45c0962e2dc412273
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 da0e21a7ce109670c81ff13d0bebde2f160022c81477b4fcd3ceb2ab426f3502
MD5 37a9bf3f9089371a74c482a14cecc6bc
SHA1 6cdca6ad15b3a65724434b90dcf17d39481fec09
SHA512 b9c6b25a7d9753a349218705a8971f28b0da158cc7a99dcea34789539bacf2c20795d4b6c93419c255d62253d1cd5a79928359e046c6ce01504c28169b22e1d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b368a23739f2e43d704500fb9768fbc69efa754cd95b882f37aea0b6453f2b24
MD5 ef6845888a26834164d925e9b991cc95
SHA1 818001025a16d7952f64324e2c149a620e5f3d7d
SHA512 064d003d9d93dae09467b6fcea83728e0c490708aec9681ad7df4203c9b057d489e3960d85015eb8c6b063e5f5805bb612cf3a02c8b7cd1eaaec0dce27626f8c
MD5 SHA1 SHA512

Submit Download

SaveTest.exe

Path C:\Users\Admin\Downloads\SaveTest.exe
Size 832KB
SHA256 0df903407be530d17acd39e9f1e6a742e5a1c542955e06981d0472b4edfc0f78
MD5 104692b3177a3ed2f7724958f9fb21b4
SHA1 4de7e133a2f6a57e423bd1ba11c9f0b8796193d6
SHA512 f442af1ee6945f21166e42a5bc7491aeadbcfd7470cbc69a173aec95ca0485e370bf1e7f14357ea3a9a06b479ac64ff5ca89915107772ca171952f15dd62b52f
SSDEEP 24576:m9+EM0q9+EM99+EM0q9+EM099+EM0q9+EM0q9+E29+EM0q9+EM0q9+EM0Oa:U+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+Et
TLSH
T1AD051909F94340B1D92B51F04DCFE3BF8A60BB2586128EF7FB4ECB5BA523B616428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveTest.exe

Path C:\Users\Admin\Downloads\SaveTest.exe
Size 80.6MB
SHA256 86af79ea1855bbc8ff982554da4efaaec04bf52d86d8688d4f1eeab5acb62bf0
MD5 950a4cc9a6db723161d8494f7b79b351
SHA1 e5ea9888619be67e7c29fb410dd9d16d8d3b0e9f
SHA512 595acd757fe7879555132b96ac1d1876c8d9f7b52b554af9f1888ad64e99fe0d5d03a06ddda668edd750ce4abbe9b58b5774356ff6edef19aa958a72ff00e17c
SSDEEP 196608:5PPPPPPPPvnS0PPPPPPPPvnS0PPPPPPPPvnS0PPPPPPPPvnS0PPPPPPPPvnS0PPd:tZZZZZi6Zl
TLSH
T174084C09F94344F1D92B51B04DCFD2BF8A70BB2586128EFBF74DCB1B6923B616828255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 db2b87e6e9d0d73d6a4aab7bf62c451f94fe4a409acabb6c2e27e5dcaf657d81
MD5 8dcc8004e586719ceb361b8030d4dff8
SHA1 8d98134b68c600e8dde1c453bc9a511481b3be06
SHA512 1bc8e93b33cc57e03535a03ef06c5367cc86120844ce78a57a856719409849fff06535723921896121eddf684f58d9fae2366c842c42e768c22e6c665214b6ab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a02311f5fdf1b698a955146f1beaaa75d8df7e46907aa54c1c55d0455e285fdf
MD5 c6c547c4e68c621481f7c5b222b4ba39
SHA1 a1295e31dc3ab8aee3c804f1357af89997d90e17
SHA512 d34b597cc04d20a4a543103d0f4b078e981b0f1fd807514571aef9c7595cc6187617e7dd778f354e1c290740ff498be18f5c4c5e3aabe139e9381e71f700f179
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 79f4572883b85aecfa845178e5e6a7fea31347e03ec19b2a761a584508b531b8
MD5 d4bbc7ed75b0d7412936d772bcf28ca3
SHA1 b5933db1f3295a584ad9edaf2b4ea6344da7d764
SHA512 d33a3242eb9b5317e330e56a7ee08ac7fac3dc0f0dcb036f9a3c628e907e91082cb1eccf43937d9b6bdd987e7dc3a2fee0700fb95f68a85bcbb8eb910ef4679b
MD5 SHA1 SHA512

Submit Download

svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe
Size 13.3MB
SHA256 5bd7dc247370020998200508fbfa5b4ba497003a601157b809851ee38a0f72b5
MD5 d1fdb708581139d3663c91c2417f425c
SHA1 e0f1938fe0244e862900ffced56a8254cf95ece2
SHA512 669676df6edf656fe8039b46c9c650d2c38971524dff46936f86c5785411616efd50ce62d224fafabe624e4ad97f6e80a400bd29d6a034f6102544e656c12e51
SSDEEP 49152:U+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Epe+ES+Ey+ES+Et+ES+n:5PPPPPPPPvn7Oi
TLSH
T1D2E64C09F94344F1D92B51B04DCFD2BF8A70BB2586128EFBF74DCB1B6923B616828255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAACCBCBACAABBBCBBCACACCBCBCBBACCACAACCAACCCBCBACBCB.exe
Size 2.7MB
SHA256 417bd22b54d5552a717f7a0240cd232b5e84ab7331ba6a6adfd5d8e21759c7a0
MD5 fd592531203e027ff88ef93cb184404a
SHA1 e0deb63339d976bbb5c28f7dfed1869e575645a0
SHA512 4994b16121fd3f9bb50fdee5233b30955bfffcd8834c71015588d816ec7f50024ddde1b76801b4bc964c8cdd2d3d42af524466bab6066147a43b9e71d45e7efb
SSDEEP 49152:U+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Epe+ES+Ey+ES+Et+ES+h:51
TLSH
T144D54C09F94344B1D92B51B04DCFE3BF8A70BB2586128EF7FB4DCB1B6923B616428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3428-48-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/3428-70-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/3428-94-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/4188-49-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/4188-71-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/4188-0-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/4188-23-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/4188-12-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/4804-85-0x0000000000010000-0x0000000000031000-memory.dmp

Download