23601a6a071ae1d48c2b30d8b20972e1e435fdc76c5e0a84de3f72506b3e407f

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_f794a91c6c66233684d36fb40c202948_elex_stop_vidar.exe
Size 3.6MB
Sample260810-b416jayelc
SHA256 23601a6a071ae1d48c2b30d8b20972e1e435fdc76c5e0a84de3f72506b3e407f
MD5 f794a91c6c66233684d36fb40c202948
SHA1 ee8bcba4226c731e708682455c5e735b2f756f2c
SHA512 4e125918c7bd89dbc64936139afa191622d0d7ae443b29d7fda091b4c0fd4e5fc931e130dca68f945eab46dd47842ab73906e2ee614ab27d12572720796168c2
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCWY5d+E6Dd79WCY+E6Dd79WCY+E6Dd79WCX:Jp7Dp7Dp7N5Op7Dp7Dp7N5ip7Y
TLSH
T18D067C1077C18031F5B328768ABFD379692879314F2886CFE788662E5E716E0E93571B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5400	svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe
1180	svchost_BACCCAACAACBBABABACBBCCACCABAAABAACAAAAABABCCCCACCACAAA.exe
3608	svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBABBBCBBCBAABACAABBCBBAABACBCCBACAACAACACBCABCCCBCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCCAACAACBBABABACBBCCACCABAAABAACAAAAABABCCCCACCACAAA.exe"	svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBACBABABBAAACBCBABAACCCBBCACCBABCCCBCCABCCCBCAAABBBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe"	2026-08-10_f794a91c6c66233684d36fb40c202948_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5308	sc.exe
3388	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2452	cmd.exe
2456	cmd.exe
5728	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_f794a91c6c66233684d36fb40c202948_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCCAACAACBBABABACBBCCACCABAAABAACAAAAABABCCCCACCACAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1380	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5716	2026-08-10_f794a91c6c66233684d36fb40c202948_elex_stop_vidar.exe
5716	2026-08-10_f794a91c6c66233684d36fb40c202948_elex_stop_vidar.exe
5716	2026-08-10_f794a91c6c66233684d36fb40c202948_elex_stop_vidar.exe
5716	2026-08-10_f794a91c6c66233684d36fb40c202948_elex_stop_vidar.exe
5400	svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe
5400	svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe
5400	svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe
5400	svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe
1180	svchost_BACCCAACAACBBABABACBBCCACCABAAABAACAAAAABABCCCCACCACAAA.exe
1180	svchost_BACCCAACAACBBABABACBBCCACCABAAABAACAAAAABABCCCCACCACAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5716	2026-08-10_f794a91c6c66233684d36fb40c202948_elex_stop_vidar.exe
Token: SeDebugPrivilege	5400	svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe
Token: SeDebugPrivilege	1180	svchost_BACCCAACAACBBABABACBBCCACCABAAABAACAAAAABABCCCCACCACAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5716 wrote to memory of 2452	5716	2026-08-10_f794a91c6c66233684d36fb40c202948_elex_stop_vidar.exe	91
PID 2452 wrote to memory of 1380	2452	cmd.exe	93
PID 5400 wrote to memory of 2672	5400	svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe	94
PID 5716 wrote to memory of 2456	5716	2026-08-10_f794a91c6c66233684d36fb40c202948_elex_stop_vidar.exe	97
PID 2456 wrote to memory of 3388	2456	cmd.exe	99
PID 5716 wrote to memory of 5728	5716	2026-08-10_f794a91c6c66233684d36fb40c202948_elex_stop_vidar.exe	100
PID 5728 wrote to memory of 5308	5728	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_f794a91c6c66233684d36fb40c202948_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_f794a91c6c66233684d36fb40c202948_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBBCCBACCCCAAABCACAACAABAAAACABACCBAABBCBCCACCCCAACBAABBCCCACBACCBCBBCBACAAACBABCCCACCAABAABBAABCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBBCCBACCCCAAABCACAACAABAAAACABACCBAABBCBCCACCCCAACBAABBCCCACBACCBCBBCBACAAACBABCCCACCAABAABBAABCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACCAAABABCBCAABCCCABCCBBBAABACABACACCACBAABCCBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe" start= auto displayName= "UserDataSvc_BAACCAAABABCBCAABCCCABCCBBBAABACABACACCACBAABCCBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACCAAABABCBCAABCCCABCCBBBAABACABACACCACBAABCCBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe" start= auto displayName= "UserDataSvc_BAACCAAABABCBCAABCCCABCCBBBAABACABACACCACBAABCCBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACCAAABABCBCAABCCCABCCBBBAABACABACACCACBAABCCBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5728
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACCAAABABCBCAABCCCABCCBBBAABACABACACCACBAABCCBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2672

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCAACAACBBABABACBBCCACCABAAABAACAAAAABABCCCCACCACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCAACAACBBABABACBBCCACCABAAABAACAAAAABABCCCCACCACAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe
1⤵
- Executes dropped EXE
PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 da5726fcbe531b218796453f697d74abbad08cf651956c3a2bd10f1e864fc1d9
MD5 cc69360d4e9952e54ed0ba20b7fa915a
SHA1 7fc30c75a981a798682be5579b7acf9f48977d5c
SHA512 496aaea781ac732ead88f2ab44fdb650b5e4043979e08c936259b1f15081d62aaafbc5b48e29d9ed4c52823492b5de011bbad377e04f9edd4ba7e19219f2ea94
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bb463f31f474d6e1bb956efc0665dc8bf670772f3e4fd90c6326098a6e5482e7
MD5 b5a9f976ce4b0c4ccffc050f16ee58f9
SHA1 d97612f8fff31724da4cb315714dd6c418f14a98
SHA512 1dcfa37521fb5e77bba0026dada52bd8a8cfa18420a4457e0d798c77780d600d9432d9c1aa8b172aaa673012b7fcd73adb9e835c9555d3835951934f2b6c2442
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fec6091de5660eaa3e2ea73fb1ece731c77eea5fa1862d70b8bc2deae0aaf121
MD5 d1247b3974fd411b04d767ab006d3d7d
SHA1 a4b5cbe83f3fce24ad1684714856be936d54edb7
SHA512 a47769d7760dbea91850c311e29bcca7b396141d6f180bc4f5d5f551adbc951834d9f20d4d2fe216ff6df06f87f01520e5b6ec567866fc392de28109dc6dfe75
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b38ac0f6b9194e46728183be56da57230c49aacfe83ca7829e652fd2e6527031
MD5 44a9fe3154b6d64d7dd1f80c01a3c350
SHA1 0fd179097cda8988f9936c8a64ae1d462a84f1a6
SHA512 eada4ad3a2e040868ead88d92084d590bdd19191c4bfc61ed045a989b7f4910dc1ef3d7ba7c8b0f59b4b0c77b705524938d0dd9f525a5f4d990f2e802b58673f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1ff7e7bcb8275914d10772aee577149b4852247127e6387841044df4d07a0498
MD5 2653023482283675dd716b021f34ae45
SHA1 67551f918b8de76b575f554092a83cea83c79ad8
SHA512 c3da4cb81c86acfb08159476ab4ccd515b9b8f4ce4a0d51bcff45f3ae666397b2977b3afcd1394b85f95111814e1c5c59942123849c5749a2b22b9336d299117
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c36cdd15006c09585b92624ab13b8b81b93c535617d3cc1325f39bb8bfbb8f9d
MD5 e3e68d36582b82a336d64ce0b85d6452
SHA1 d0312f3d798104ca8d68ecdda3858023a75b78b3
SHA512 e963746d8e8829ef0044ee853fd2ef6cfc0c44f3b29861c364804b2e0cf1ff85a676b15369d552338a910b7e3c9cd7c2cefda5b428471e6ca47d18570b709813
MD5 SHA1 SHA512

Submit Download

svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACBBAACAABBBACABBACAABBABBCABCCCABCBCACABABBCBBBBC.exe
Size 3.6MB
SHA256 23601a6a071ae1d48c2b30d8b20972e1e435fdc76c5e0a84de3f72506b3e407f
MD5 f794a91c6c66233684d36fb40c202948
SHA1 ee8bcba4226c731e708682455c5e735b2f756f2c
SHA512 4e125918c7bd89dbc64936139afa191622d0d7ae443b29d7fda091b4c0fd4e5fc931e130dca68f945eab46dd47842ab73906e2ee614ab27d12572720796168c2
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCWY5d+E6Dd79WCY+E6Dd79WCY+E6Dd79WCX:Jp7Dp7Dp7N5Op7Dp7Dp7N5ip7Y
TLSH
T18D067C1077C18031F5B328768ABFD379692879314F2886CFE788662E5E716E0E93571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 620f073b2d15044a7e344cf074ad2f0f53316b19aa824a7adfe059119258a0ff
MD5 73dd21c617f892d3e462305c02fb2cd9
SHA1 cc118dc29abb8d9c31e787416f0f2136d590bb2b
SHA512 e00dd78107b064ebb35228c2c261e54c2865c85bd9b38f994428dfe6fa09e467a71ff7c0ed8049063f75abf646c933b200710a1b056886866c6fccce1ae1ca10
TLSH
T17E11E371D5B9DC67FD32244E8A1EAF525CE4365FBC9C6A14230943186BCDC30CD594E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1180-70-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/3608-81-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/5400-33-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/5400-23-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/5716-7-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download

memory/5716-0-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download