53f75235f4fa5244aa4d8ade55110af0232a27c164c5d870eb75d7db0c50ccfa

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
Size 4.5MB
Sample260810-cb3dkaszds
SHA256 53f75235f4fa5244aa4d8ade55110af0232a27c164c5d870eb75d7db0c50ccfa
MD5 ccfe53cc84933f272e9695d474b52052
SHA1 fddaabfc0c0aa4b975d69fb75f03526941824d16
SHA512 392050664389279b39b8d6e96f39447217565ee908c409ecea02a90f47da1a3f041f55061729598544098ec0b7515e7a8dad0d74ae8b92f259ea339b5b747908
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WC9hOd+E6Dd79WCY+E6Dd79WCy:Jp7Dp7Dp7Dp7z3p7Dp7Dp7Dp7zs
TLSH
T112267B10B7D18035F5B329328ABFD3399539B8715F2586CFE388463E5E71AE0A934B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1000	svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe
472	svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe
4224	svchost_BABBBAABABCBCAACCBBBBACCBCCCBAAAAAAAACCCCABBCBBAAAAACCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBBCABCBAACACBBCAABACBCACAAAACAACCCCBCABCAAABABBBCCBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBBAABABCBCAACCBBBBACCBCCCBAAAAAAAACCCCABBCBBAAAAACCA.exe"	svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCCBCCACBBBACCCCBBCAAABCACBABCBAABCABCCCCBBBCCBACAABBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe"	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4316	sc.exe
1060	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2628	cmd.exe
4768	cmd.exe
3256	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBBAABABCBCAACCBBBBACCBCCCBAAAAAAAACCCCABBCBBAAAAACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3012	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
3012	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
3012	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
3012	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
1000	svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe
1000	svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe
1000	svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe
1000	svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3012	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
Token: SeDebugPrivilege	1000	svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1708	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2628	3012	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe	104
PID 2628 wrote to memory of 3884	2628	cmd.exe	106
PID 1000 wrote to memory of 2204	1000	svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe	107
PID 2204 wrote to memory of 4140	2204	notepad.exe	108
PID 3012 wrote to memory of 4768	3012	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe	110
PID 4768 wrote to memory of 4316	4768	cmd.exe	112
PID 3012 wrote to memory of 3256	3012	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe	113
PID 3256 wrote to memory of 1060	3256	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCCAABBBCCAACBCABAAABABABBBABCCABACAACCBCCCBACCCBCACCBBBCBCBBBBAACABBCBACABCABACAAACCCABBBAAACAAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCCAABBBCCAACBCABAAABABABBBABCCABACAACCBCCCBACCCBCACCBBBCBCBBBBAACABBCBACABCABACAAACCCABBBAAACAAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCBACAABABCABCABAACACCBBCAAAABCABCBBCBBBAACCAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe" start= auto displayName= "UserDataSvc_CBBCBACAABABCABCABAACACCBBCAAAABCABCBBCBBBAACCAACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCBACAABABCABCABAACACCBBCAAAABCABCBBCBBBAACCAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe" start= auto displayName= "UserDataSvc_CBBCBACAABABCABCABAACACCBBCAAAABCABCBBCBBBAACCAACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCBACAABABCABCABAACACCBBCAAAABCABCBBCBBBAACCAACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCBACAABABCABCABAACACCBBCAAAABCABCBBCBBBAACCAACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4140

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe
1⤵
- Executes dropped EXE
PID:472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBAABABCBCAACCBBBBACCBCCCBAAAAAAAACCCCABBCBBAAAAACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBAABABCBCAACCBBBBACCBCCCBAAAAAAAACCCCABBCBBAAAAACCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d514833b260864cfe57c3fd7e41d3069825aabf3e58fca0672aab54e2414ada3
MD5 9e1f2aeb15846345759bc5c0fefdd8e1
SHA1 3bae1290894992f1dce696c276c56439a7681103
SHA512 8fb76ed5337bcd56e26ae249891b1a10f384a246699ad2f3f8493c6c26343a4f66ecf528edcb80edd7e964561457bb4fc8a30d9820561fc6bfbf0129a27f3cf8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 879bf417dccc90e9b3e12db84e3be1e2b2b4858983b18f54b2235bcef963fa7b
MD5 53a7dd0883d12d581e642cced7ec7d57
SHA1 9d3d78f2d57344229e4780d88b2cde78d18bd1fe
SHA512 50f0aaae9065b96b2504a1b46afc6e44a9d9025607c71b4788b0d1a44ccc38c8efc3b496a09d2e1b1d8dd00272e5fa677dc37ec8e735c865d77fab310e057ef4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0bf626d67b536252072c287e67bd5e1471ebae0506d9a36512b1f4834f2f3826
MD5 ecbb8e46bb301580247b6a258fc49062
SHA1 acbe3b514c3d8ecf594e0333cfc26f51c3f7fa8a
SHA512 8142713d2be4c9dc0496cb2f230ad454b5d4212a16329a779fecc962df3ee6a9d266e2477db738c306001bd3bc1a6f36e82b3bafe9c5c6c55d04aa1e293e80c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 641b99e143b31920e2ad80bc598d6c97daa65dde2a6fa0e75ab76beeaa07cdb9
MD5 5d8d0beab9b7d53ace53573d44091848
SHA1 9d786286da46ab3201aa81349f27779a14c332f8
SHA512 9c555b963cdabbdaf6810ea2cc1f991d2e8c3d80141ffd212fe0aeace906d5713d8a502ce5e8b69985a18a9d09aea46ad728ad17f1cec3f44eb8a0677047ae9e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 82d117ea834f91f138a75152016aae6dfd2c8561b7f929220a8516fa1abc60d0
MD5 12a79a10179eeea7f136bd3b4c782e47
SHA1 e082413b132861c42ae232cf9cdbbf6c9949ae3f
SHA512 18989447d477703de1c1dccb725e1d11aa4fde9d891f2252c931af3fe66b8a14e53700ef3c362acb99fdbf904e29c68b1c50c3005ee2a588dd9d257459d829f0
MD5 SHA1 SHA512

Submit Download

svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCBBAACACBBCABCBBCBABBBBACABAAAACBCCCBABAACACCBCBC.exe
Size 4.5MB
SHA256 53f75235f4fa5244aa4d8ade55110af0232a27c164c5d870eb75d7db0c50ccfa
MD5 ccfe53cc84933f272e9695d474b52052
SHA1 fddaabfc0c0aa4b975d69fb75f03526941824d16
SHA512 392050664389279b39b8d6e96f39447217565ee908c409ecea02a90f47da1a3f041f55061729598544098ec0b7515e7a8dad0d74ae8b92f259ea339b5b747908
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WC9hOd+E6Dd79WCY+E6Dd79WCy:Jp7Dp7Dp7Dp7z3p7Dp7Dp7Dp7zs
TLSH
T112267B10B7D18035F5B329328ABFD3399539B8715F2586CFE388463E5E71AE0A934B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-75-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/1000-26-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/1000-39-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/2204-60-0x0000000005440000-0x0000000005441000-memory.dmp

Download

memory/3012-7-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/3012-0-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/4224-80-0x0000000000150000-0x0000000000171000-memory.dmp

Download