dbf16ec73a3b3e4c6f12136f3fcff1b690042fa3645e3c2192f147df111a89d9

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_de5f5646310015a402b39d3e12684495_elex_stop_vidar.exe
Size 3.4MB
Sample260810-b85phsyfjc
SHA256 dbf16ec73a3b3e4c6f12136f3fcff1b690042fa3645e3c2192f147df111a89d9
MD5 de5f5646310015a402b39d3e12684495
SHA1 045ba1993dd009d7507b27b8fcf8cd0294a08a67
SHA512 716e01d7808a0c0e45d799fab8825362b0c2385fb9e2727569aedf567ff408b16e16c52864c1976074fdbff05f382aabdc94570cf972d57dbbbbd2cbb75e9391
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMG+ElwMV+ElwMV+ElwMV+ElwMnDd79WCn:np71
TLSH
T1A1F57F19FA880CF1E873517D8587C629EA7274251B21CBCBB26C832F2F276E5AD35711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
2196	svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACABABCABBBCCBBBCCCACCCCAACCBACCBCABBCBBBBCBABBABACCBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe"	2026-08-10_de5f5646310015a402b39d3e12684495_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4784	sc.exe
4948	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2924	cmd.exe
2168	cmd.exe
3284	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_de5f5646310015a402b39d3e12684495_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1140	2026-08-10_de5f5646310015a402b39d3e12684495_elex_stop_vidar.exe
1140	2026-08-10_de5f5646310015a402b39d3e12684495_elex_stop_vidar.exe
1140	2026-08-10_de5f5646310015a402b39d3e12684495_elex_stop_vidar.exe
1140	2026-08-10_de5f5646310015a402b39d3e12684495_elex_stop_vidar.exe
2196	svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe
2196	svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	2026-08-10_de5f5646310015a402b39d3e12684495_elex_stop_vidar.exe
Token: SeDebugPrivilege	2196	svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2924	1140	2026-08-10_de5f5646310015a402b39d3e12684495_elex_stop_vidar.exe	96
PID 2924 wrote to memory of 2388	2924	cmd.exe	98
PID 1140 wrote to memory of 2168	1140	2026-08-10_de5f5646310015a402b39d3e12684495_elex_stop_vidar.exe	99
PID 2168 wrote to memory of 4784	2168	cmd.exe	101
PID 1140 wrote to memory of 3284	1140	2026-08-10_de5f5646310015a402b39d3e12684495_elex_stop_vidar.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_de5f5646310015a402b39d3e12684495_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_de5f5646310015a402b39d3e12684495_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACAAAACCCBCABBCABBCCAAACCABAACACCACBAABCACCCABAABCCBACAACBABBACACCACBCCCCACACBACBCCCACCBBBBBBCCBACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACAAAACCCBCABBCABBCCAAACCABAACACCACBAABCACCCABAABCCBACAACBABBACACCACBCCCCACACBACBCCCACCBBBBBBCCBACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAAABBBABAABBCCACCBCCBBCCAABBBBBCBABBBACCCBABACACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe" start= auto displayName= "UserDataSvc_BAAAABBBABAABBCCACCBCCBBCCAABBBBBCBABBBACCCBABACACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAAABBBABAABBCCACCBCCBBCCAABBBBBCBABBBACCCBABACACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe" start= auto displayName= "UserDataSvc_BAAAABBBABAABBCCACCBCCBBCCAABBBBBCBABBBACCCBABACACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAAABBBABAABBCCACCBCCBBCCAABBBBBCBABBBACCCBABACACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3284
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAAABBBABAABBCCACCBCCBBCCAABBBBBCBABBBACCCBABACACA"
    3⤵
    - Launches sc.exe
    PID:4948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2196

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 95ca09de90c5f404f1bbd3d0f41d1f45baa23bc094fcc2dd24ce80057222ef72
MD5 9f67073f705d7f469c4a0dcec6b7381e
SHA1 14025d3164a929e5302f8f2cfd52a3ab67d1dce3
SHA512 a04fa4442957e8ee1a68c0bdda4e68b044c5b8abae5bdd2c099da12ad26cc208a49cf73fee42af954b5a62a4e9a202b623190e9f285781ed8ffab162c323aded
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5626376fcdab4ea84523d3c4038f79c706676f47a9b55b47cd04b0827e1b9f24
MD5 48b688bac2e9c250eaa62279f4022c0e
SHA1 1a784878909c932068550cb43225a4ad6d19bbdd
SHA512 02a6e08cfefcfb886c3399d9e74646054346754b7efe69d6f8534d7cc5d9df6e94620eb767637f7a6ca2f4a9c5042471ed3cb334aa2f4a14bcbe4d098a921b3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2de05d8a21534488eaa604e6247868e2b6953592d2347c4483e1c1e823ad598b
MD5 86cae501c286885a46f2919bf0034d13
SHA1 7cccb00c9ae9ad6fec25f1cbcd59a740e1c16f29
SHA512 eab520a9be4201e776cda1ba7d5085c34bd48fd31be49d46d4045f44d3fc2114f04df41248657cf3ad3fd46377a5b2616d0ab54ef94e3fcb1ee1a60e6ffea0f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cca672512d029672569e1be90c51dc75aaedbf589201ffd45ffa7fb4d7f07adc
MD5 39224e41c5c8f017814885ac32817e00
SHA1 2fb6f8c45241e27eaceb361c13f43b47766714f8
SHA512 0359863daf573bd1110c6c0127cc136d7329308b8f41d03526274b007797a48d1a86655be02a9da10974066aa2a2ae087573f6b7c1a763f3bf6a898809f2af5a
MD5 SHA1 SHA512

Submit Download

svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe
Size 3.4MB
SHA256 dbf16ec73a3b3e4c6f12136f3fcff1b690042fa3645e3c2192f147df111a89d9
MD5 de5f5646310015a402b39d3e12684495
SHA1 045ba1993dd009d7507b27b8fcf8cd0294a08a67
SHA512 716e01d7808a0c0e45d799fab8825362b0c2385fb9e2727569aedf567ff408b16e16c52864c1976074fdbff05f382aabdc94570cf972d57dbbbbd2cbb75e9391
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMG+ElwMV+ElwMV+ElwMV+ElwMnDd79WCn:np71
TLSH
T1A1F57F19FA880CF1E873517D8587C629EA7274251B21CBCBB26C832F2F276E5AD35711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABAAACBCCCABCBCBBCCACBBACBCBBCCACCCABBBAAAACACCAAB.exe
Size 659KB
SHA256 5ca6917e5030f2de22c267d096cf76aa6b0e6d17ffa0761b116ef5de8e1c221b
MD5 dc31ddb6e4d23c3847dd159301aa8aea
SHA1 0be7d556ea4514ac0d7b8457a4f4cdf86ab8adff
SHA512 d61cf6619e2d346bc4dc0f46173c13656a38a5bc65b718e29cc7529f3ce59b168a46d624690f08ca6fa9eff29022d3bb5fb556c1000901ff5a1d5c85e0766b46
SSDEEP 12288:mgUFgEsnojAcwYkUVY3nMkbZ6gUFgEsnojAcwYkUVY3nO:m9+EM0bwMOZ69+EM0bwO
TLSH
T121E47E29FA9C04E1ED73517C8587C52ADAB274261722CEC7B678C31E2F276E5AC39701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1140-0-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/1140-8-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/2196-28-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/2196-41-0x0000000000440000-0x0000000000461000-memory.dmp

Download