4ee9fc469df9b5379316dc1beaf12750c2127c6326ae984dabb69ba107c9b070

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 22:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_8d519b349f662b9dfe87dd6da931527a_elex_stop_vidar.exe
Size 21.9MB
Sample260810-12vcmsan4x
SHA256 4ee9fc469df9b5379316dc1beaf12750c2127c6326ae984dabb69ba107c9b070
MD5 8d519b349f662b9dfe87dd6da931527a
SHA1 0577831cfbdca838bf1c0af33a3a16050e0478c5
SHA512 6e6c1efd34035b789f8ef1db428ecd2c5e546c5e9ce19f6ccbf49fa02464ff3a3ef9c5ceaa3ac02619b390aaa05469ff24cebb2de7d67bf733a8a2e68689195a
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+Ee:Zp7l
TLSH
T114374B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1344	svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe
5756	svchost_CBBABAACBABBBBBAAABABCCBBBACBBABBABACABBBACCCBBBBABCCAA.exe
356	svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABACCBBBCBCCAAAABCAAACACAACABCACABCBBCCCBACCBBCCCCCCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe"	2026-08-10_8d519b349f662b9dfe87dd6da931527a_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCABABCCCABCACACAABABCCCBCACAABAABCCCBCCCBBBBABCCACBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBABAACBABBBBBAAABABCCBBBACBBABBABACABBBACCCBBBBABCCAA.exe"	svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5044	sc.exe
4232	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5268	cmd.exe
3240	cmd.exe
3936	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_8d519b349f662b9dfe87dd6da931527a_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBABAACBABBBBBAAABABCCBBBACBBABBABACABBBACCCBBBBABCCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3668	2026-08-10_8d519b349f662b9dfe87dd6da931527a_elex_stop_vidar.exe
3668	2026-08-10_8d519b349f662b9dfe87dd6da931527a_elex_stop_vidar.exe
3668	2026-08-10_8d519b349f662b9dfe87dd6da931527a_elex_stop_vidar.exe
3668	2026-08-10_8d519b349f662b9dfe87dd6da931527a_elex_stop_vidar.exe
1344	svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe
1344	svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe
1344	svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe
1344	svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3668	2026-08-10_8d519b349f662b9dfe87dd6da931527a_elex_stop_vidar.exe
Token: SeDebugPrivilege	1344	svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 5268	3668	2026-08-10_8d519b349f662b9dfe87dd6da931527a_elex_stop_vidar.exe	95
PID 5268 wrote to memory of 5900	5268	cmd.exe	97
PID 1344 wrote to memory of 5920	1344	svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe	100
PID 3668 wrote to memory of 3240	3668	2026-08-10_8d519b349f662b9dfe87dd6da931527a_elex_stop_vidar.exe	103
PID 3240 wrote to memory of 5044	3240	cmd.exe	105
PID 3668 wrote to memory of 3936	3668	2026-08-10_8d519b349f662b9dfe87dd6da931527a_elex_stop_vidar.exe	106
PID 3936 wrote to memory of 4232	3936	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_8d519b349f662b9dfe87dd6da931527a_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_8d519b349f662b9dfe87dd6da931527a_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACCCCACABCABBCABABCAACAABBCCACCCAABAABBCAAAAACABCBABCBBABABCACBCABACBACBBBACBACABACABCABAACBCACAABBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACCCCACABCABBCABABCAACAABBCCACCCAABAABBCAAAAACABCBABCBBABABCACBCABACBACBBBACBACABACABCABAACBCACAABBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACABCACCCBACABCABCCBBABABCAABACABBCBACABABBCABAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe" start= auto displayName= "UserDataSvc_CACABCACCCBACABCABCCBBABABCAABACABBCBACABABBCABAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACABCACCCBACABCABCCBBABABCAABACABBCBACABABBCABAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe" start= auto displayName= "UserDataSvc_CACABCACCCBACABCABCCBBABABCAABACABBCBACABABBCABAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACABCACCCBACABCABCCBBABABCAABACABBCBACABABBCABAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACABCACCCBACABCABCCBBABABCAABACABBCBACABABBCABAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4232

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABAACBABBBBBAAABABCCBBBACBBABBABACABBBACCCBBBBABCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABAACBABBBBBAAABABCCBBBACBBABBABACABBBACCCBBBBABCCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5756

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe
1⤵
- Executes dropped EXE
PID:356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JoinStep.exe

Path C:\Users\Admin\Desktop\JoinStep.exe
Size 44.4MB
SHA256 e9fc1a500ea4a25505f9650a7b3589ff562961c996af1b33787e4c943cf52f20
MD5 b86cbf3d94a9761648f870d832c17c20
SHA1 7b1236faa687eed16e1f6129872dee61c15a0cbf
SHA512 7b2a321e4c688c28fc7feaa57695ca6732a3b66c9e18dd242b8c871d380458837049d97420862210927899272d890c34e8b7fd1625b53bd917ed4c58891dd6cc
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+Ey:Zp73p7KhQe5wp
TLSH
T154A75B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9c92b01fcc83c838ff2e95c7d5bf1687a18bfac12d9bf1a7ad01d553b1afae56
MD5 117b8d32392f4be7834dac7f265371f2
SHA1 b9957a96c55291b24ea4b4e3ada8c600e1e9581d
SHA512 0e42c08a2cdc3a18073cc8deb0a4434221b6db18911c1ba420dff555ff3eab7696c556b7ffa492cb73316a32df695e4697c03711de539bef696807ac864d0344
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 589b0629e7c9e252914686f3b2cdb33cbbed6d6f5b8655e07ae0fff681de0221
MD5 14a4000c22c98bb5e106d1965808b2d4
SHA1 d6b6c94885c125c8013a988f04c27e6938dceead
SHA512 193616ff4cd9dfed0d8a33db8edc1128c28d5fac1abe496fc8149e785933183c5efb8cfb47dc3e419f0ec1f23cbba53406a90bfae16d98387d390bcf2e4e7b26
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6678b9d028aee286753c863ba27aaf0f087a1894885a0bb4576aa703f35e4397
MD5 73e725171d34cd0f659c24ccdfecb2df
SHA1 913e8c9fce6d33b0101ec783d4846d9feddc43db
SHA512 361cf4e8e4651fa00828e7adaadfe5f808784e27ac537d54507847186295d0a88b88fa6f2b8b3fef010bfc584ce7cd79099fa304936ccdbff601a2c9f8536796
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d7eaaca412b9c1ebc0347567ddd0f6ac8708b21b006342cb15ad833907143204
MD5 e74afd310e9b9988f08b8fd71e9ea9df
SHA1 52ae2c7380a128e8af7961ac69973d226ef542fb
SHA512 0645d1811b598fc596aced6dc9ca35520f1e8b6d28a6184c30b16d0141348f63c57683b3524a896e84e31674d43192c58cb40e63be955ae021ae89c4d8901402
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dba94723b1e2400f9cfb84b90f937dd4bafcd93872c437922bae767eb860b16b
MD5 ce6ad11989081d8b1e050b29d1955499
SHA1 46cd9ccd27e116339cf7139334fc700583b7f539
SHA512 32297c081924922952501afea065b4c4fc7e70782bba1593afc03a28e8fdc0d39c155b759bf6357627b3a6c992210f6de972d7d06cfe8838484543e380467123
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9318b67c8f2c50127c726e315bdc0a69cef53320a7c8ddca975fe0540fc01d0a
MD5 179b623f3137cf93d317e20234d4b3a4
SHA1 2779dfdcedf7dda01cf9d0277231922d7f49c0e0
SHA512 a9a5f86983035e74ea74b3698d3559bbcfe76c82bf91501e7898269e3e6f52f8e2973323f4ee1fa163c0745dd7f7f2809c89570b02b6ce58a4f2a41dce0cdede
MD5 SHA1 SHA512

Submit Download

svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCACBBAACCCCCAAABCBAABAAABCBABBBABCCABCACBBBCCACBC.exe
Size 21.9MB
SHA256 4ee9fc469df9b5379316dc1beaf12750c2127c6326ae984dabb69ba107c9b070
MD5 8d519b349f662b9dfe87dd6da931527a
SHA1 0577831cfbdca838bf1c0af33a3a16050e0478c5
SHA512 6e6c1efd34035b789f8ef1db428ecd2c5e546c5e9ce19f6ccbf49fa02464ff3a3ef9c5ceaa3ac02619b390aaa05469ff24cebb2de7d67bf733a8a2e68689195a
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+Ee:Zp7l
TLSH
T114374B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1344-64-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/1344-44-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/1344-90-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/3668-45-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/3668-78-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/3668-0-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/3668-30-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/3668-16-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/3668-108-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download