62b0982d661cd021f278a91d0cdc10590b3e8ce1fdf7cca54e39b844ebe2c7c7

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_eba8eb7a3f2bdad4a0fddacdab593941_coinminer_elex_hijackloader_vidar_wannacry.exe
Size 60.3MB
Sample260910-k6gpcaam3v
SHA256 62b0982d661cd021f278a91d0cdc10590b3e8ce1fdf7cca54e39b844ebe2c7c7
MD5 eba8eb7a3f2bdad4a0fddacdab593941
SHA1 9ddfee29536b10f9e283e53834df8e52bc74c495
SHA512 e8427a42fda1502b08bb6c6e0056c2a059841d81d74d644fbb8d8bad5a851cfdbce46e6c60b1b6964af0b3d546d859ffa232d02f8cd2add5ba08544452e4d7b3
SSDEEP 49152:U+ESH9++ESHP+ESHP+ESHP+ESHP+ESHP+ESHP+ESH9++ESHP+ESHP+ESHP+ESHPF:Bn7Or
TLSH
T1C8D73A0CE6DE0074D56AA0B08987C6BED5F17421472249EFE695CB3E1F33AE5B538B48
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1280	svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe
4204	svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe
5092	svchost_CACABABBCACBAAAABBBBABABBBCAACACAABBAABCBABCACBCBBAABCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BACCAACAAACBBBCCACABCCBABBCBBCACAACBCBCCCCCACBBCBCBCCCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe"	2026-09-10_eba8eb7a3f2bdad4a0fddacdab593941_coinminer_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AACBCABAAAAABBACCCACBABBAABBACABABABBBABABBACCBBBBCACBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACABABBCACBAAAABBBBABABBBCAACACAABBAABCBABCACBCBBAABCB.exe"	svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3080	sc.exe
2464	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4824	cmd.exe
3760	cmd.exe
1700	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACABABBCACBAAAABBBBABABBBCAACACAABBAABCBABCACBCBBAABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_eba8eb7a3f2bdad4a0fddacdab593941_coinminer_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4352	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1768	2026-09-10_eba8eb7a3f2bdad4a0fddacdab593941_coinminer_elex_hijackloader_vidar_wannacry.exe
1768	2026-09-10_eba8eb7a3f2bdad4a0fddacdab593941_coinminer_elex_hijackloader_vidar_wannacry.exe
1768	2026-09-10_eba8eb7a3f2bdad4a0fddacdab593941_coinminer_elex_hijackloader_vidar_wannacry.exe
1768	2026-09-10_eba8eb7a3f2bdad4a0fddacdab593941_coinminer_elex_hijackloader_vidar_wannacry.exe
1280	svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe
1280	svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe
1280	svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe
1280	svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	2026-09-10_eba8eb7a3f2bdad4a0fddacdab593941_coinminer_elex_hijackloader_vidar_wannacry.exe
Token: SeDebugPrivilege	1280	svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4228	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 4824	1768	2026-09-10_eba8eb7a3f2bdad4a0fddacdab593941_coinminer_elex_hijackloader_vidar_wannacry.exe	99
PID 4824 wrote to memory of 4352	4824	cmd.exe	101
PID 1280 wrote to memory of 2836	1280	svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe	102
PID 2836 wrote to memory of 5016	2836	notepad.exe	103
PID 1768 wrote to memory of 3760	1768	2026-09-10_eba8eb7a3f2bdad4a0fddacdab593941_coinminer_elex_hijackloader_vidar_wannacry.exe	105
PID 3760 wrote to memory of 3080	3760	cmd.exe	107
PID 1768 wrote to memory of 1700	1768	2026-09-10_eba8eb7a3f2bdad4a0fddacdab593941_coinminer_elex_hijackloader_vidar_wannacry.exe	108
PID 1700 wrote to memory of 2464	1700	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-10_eba8eb7a3f2bdad4a0fddacdab593941_coinminer_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_eba8eb7a3f2bdad4a0fddacdab593941_coinminer_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBABAAACCACCCAAABAAACBCCCCCAACACBABCCACBBBBCCBBCCCACBACCACCBABBCAABABCCCCCCBAAAACBBCACCCAAAACCACBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBABAAACCACCCAAABAAACBCCCCCAACACBABCCACBBBBCCBBCCCACBACCACCBABBCAABABCCCCCCBAAAACBBCACCCAAAACCACBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACABCACCBCCCBBABBABCBABCCAABABACCABABCCCCBCACACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe" start= auto displayName= "UserDataSvc_AACABCACCBCCCBBABBABCBABCCAABABACCABABCCCCBCACACBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACABCACCBCCCBBABBABCBABCCAABABACCABABCCCCBCACACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe" start= auto displayName= "UserDataSvc_AACABCACCBCCCBBABBABCBABCCAABABACCABABCCCCBCACACBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACABCACCBCCCBBABBABCBABCCAABABACCABABCCCCBCACACBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACABCACCBCCCBBABBABCBABCCAABABACCABABCCCCBCACACBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5016

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4228

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABCCBCAACACABBABBCAACACABBCBCBCCCCCBCBCBCABCBCABBB.exe
1⤵
- Executes dropped EXE
PID:4204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBCACBAAAABBBBABABBBCAACACAABBAABCBABCACBCBBAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBCACBAAAABBBBABABBBCAACACAABBAABCBABCACBCBBAABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2a5823a5f18097b86e6736093106db59581981d493d917eac09452bc824ec514
MD5 8b10114b46ee83199ea365b78afc4fc8
SHA1 8663156c107d1d96e67769e02ab946e8c1859c0f
SHA512 ba88c05f0a44598d80b4c9365729f4c13e2e99e67f5b361d87bc4351a86323b9ec49ef7cb2b53494fd2edfcc360ed1f99c4aca894aab323d973a90c42747f490
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 60c1c1a7da00af428726836629fda1f7afef9bf7e5f78b1e68cf51d88fb92a45
MD5 77aef56ae5fb4eddecf12943bb699c13
SHA1 11a56adc6dab9582a331af918e295a4c7aa5279d
SHA512 c09779e502dc52c2319c8a3a994c3d0d1202c44aab55c32cf1fabb5f94f3fd1979528ab482bb474f78231a34d0ff51edcfb5ad419e1fbfc53c9d4b329ef69d30
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c9ba200b4c1388be69f451b25950739cdb6bbcfa36b08b288068510b519e1a6b
MD5 af61f9e76af325662e1f2bf33f01ae99
SHA1 caa92de74a9f0a80458695ad1e5ca97e5b923166
SHA512 5591d224e08ae36c7433348c3762da372719463f432275eacd5d018e7f3dc06ce888fd62705b869d8fc80fc82e3a7d6f186fe55f58fd8cd12ccf5fb9f9027d90
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b93ccb9ba792cd4b840df47441d1d318fc5078e5d8c80f3d4c37559d66070567
MD5 c6232a558fd13b5ea70966f39583bfa3
SHA1 f8fe47ff7c51a2d07251fd795296f5045ad65b2b
SHA512 9f214cdd61883b14e30ebcb0aa34f1125d168a58f6bf91becf065662885a8b524750a015526bb186d4a0a703161618bc24441c75ecd9fc7fa2087178f082ba46
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bb6c6e96ddcecaacd644034a7156c1ad6fbd71de59d2ac9dcdc5ebccc2c9feae
MD5 5bc1c9b042dcfeedbebfaecc4ea04fba
SHA1 87e01dca6cc4f96c8b031738d1b5bddefbd1d7b0
SHA512 a051c371a29a734f1373a5e4f21c95b7f536e42c5faedec1c3655a23417c7693c302634a78023b19942684d224701ae3538634b3d496777df2b8c386086157b6
MD5 SHA1 SHA512

Submit Download

memory/1280-26-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/1280-39-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/1768-0-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/1768-7-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/2836-61-0x0000000005B70000-0x0000000005B71000-memory.dmp

Download

memory/4204-76-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/5092-81-0x0000000000030000-0x0000000000051000-memory.dmp

Download