53f75235f4fa5244aa4d8ade55110af0232a27c164c5d870eb75d7db0c50ccfa

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
Size 4.5MB
Sample260810-cb3dkaszds
SHA256 53f75235f4fa5244aa4d8ade55110af0232a27c164c5d870eb75d7db0c50ccfa
MD5 ccfe53cc84933f272e9695d474b52052
SHA1 fddaabfc0c0aa4b975d69fb75f03526941824d16
SHA512 392050664389279b39b8d6e96f39447217565ee908c409ecea02a90f47da1a3f041f55061729598544098ec0b7515e7a8dad0d74ae8b92f259ea339b5b747908
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WC9hOd+E6Dd79WCY+E6Dd79WCy:Jp7Dp7Dp7Dp7z3p7Dp7Dp7Dp7zs
TLSH
T112267B10B7D18035F5B329328ABFD3399539B8715F2586CFE388463E5E71AE0A934B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4976	svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe
1392	svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe
5296	svchost_AAAACBCBBCCACCBBCAAAABCBBCACBBACABACBBAACBAABBACBBBCACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCABCCABCBCABBCCBAACAAAABCAACCCBBCAABCCCABBBCCCACCBBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe"	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBCBCCCCBAAACAACCBBABBAACAABCACCCBBBCBABCBCBACBBAACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAACBCBBCCACCBBCAAAABCBBCACBBACABACBBAACBAABBACBBBCACB.exe"	svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2120	sc.exe
4320	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4260	cmd.exe
3564	cmd.exe
5932	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAACBCBBCCACCBBCAAAABCBBCACBBACABACBBAACBAABBACBBBCACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4168	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
4168	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
4168	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
4168	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
4976	svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe
4976	svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe
4976	svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe
4976	svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4168	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
Token: SeDebugPrivilege	4976	svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4260	4168	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe	92
PID 4260 wrote to memory of 5364	4260	cmd.exe	94
PID 4976 wrote to memory of 1876	4976	svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe	95
PID 4168 wrote to memory of 3564	4168	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe	96
PID 3564 wrote to memory of 2120	3564	cmd.exe	98
PID 4168 wrote to memory of 5932	4168	2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe	99
PID 5932 wrote to memory of 4320	5932	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_ccfe53cc84933f272e9695d474b52052_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABBBCBAABBACCCABCCCAABCCCCCACCBACACCCBCCAAABCBCCCBABBCCBCBACBBCCCBABACCBABCBCBBABABCAACCBBBCBCCAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABBBCBAABBACCCABCCCAABCCCCCACCBACACCCBCCAAABCBCCCBABBCCBCBACBBCCCBABACCBABCBCBBABABCAACCBBBCBCCAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABABCAAACBCAACBCACACBBAAAAAABAACCCCCBAAAACAACCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe" start= auto displayName= "UserDataSvc_CBABABCAAACBCAACBCACACBBAAAAAABAACCCCCBAAAACAACCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABABCAAACBCAACBCACACBBAAAAAABAACCCCCBAAAACAACCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe" start= auto displayName= "UserDataSvc_CBABABCAAACBCAACBCACACBBAAAAAABAACCCCCBAAAACAACCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABABCAAACBCAACBCACACBBAAAAAABAACCCCCBAAAACAACCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5932
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABABCAAACBCAACBCACACBBAAAAAABAACCCCCBAAAACAACCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4320

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe
1⤵
- Executes dropped EXE
PID:1392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBCBBCCACCBBCAAAABCBBCACBBACABACBBAACBAABBACBBBCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBCBBCCACCBBCAAAABCBBCACBBACABACBBAACBAABBACBBBCACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c8fd2bdf45348abeb90cdc4616e73f4c4fea2cad145b171f51832e7de82ad15
MD5 ce9bc9824bc16e2904e1ebbadc6d6caf
SHA1 5394fa66abe25a7fc34d9e2c7f0284184d89ce1d
SHA512 805ac75e20e8c2d8ad8abf04dd0873c4a435bafe4d2129d34dd269e21250b4f232218526ee08013e682871862f84b1f69e3e0a1fc2d5f649e508efcb85d77251
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9e67041cc144284a804f1c99c03b45fa7e8bc148c87b3e229430e7e6f7c23bd2
MD5 0efba44a3fedb764732ca78f2993978c
SHA1 5403a717747db795fc32459eb9132c41d7db42c3
SHA512 afe31e61f5117a601b221e38d8ecde04ccebe4a60dd8b22520206b415fa9302bac5d68d0d3868e2c4231fe146f449d4d3c828bef952e6b0d9f3a6a94aa84a257
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bc9e38219423b39f765726bd2fe78fb54f2e4ff34892f19d7bf7840d17f06790
MD5 122a27af050ecb35c3ffae8a6cf679ba
SHA1 7e97faec2cda3513b3da644654f4532244303c84
SHA512 128a3539dc92cddc23157375972b0815720ed37c5e20996f3f1253f4384a8d6d74e81bbed3d4b3c1ad201d35406a5726351973d352d8b9fab29b370ad88909cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a0fc7d262f859c9fbccf197e86ebb5f9c6da936f3e20899aba8410d8826d5871
MD5 88a3819b7075df37b3d925c768b1327c
SHA1 523e0ae1b102e76b48b5f8ee8397e3e6084635bc
SHA512 6aebc960d4af69e15b731f0b7c8f10fabe8bbc11e2e5968ab51b06d1cef2ac5e60873ac3ed43c0a07b1a94576f897f4bf6ca26bf31c0d3120e5f8a2b2664d1d1
MD5 SHA1 SHA512

Submit Download

svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCCCACBBBAACCCACCBACAABCAAABBBCCCAACCACCCABAABCAC.exe
Size 4.5MB
SHA256 53f75235f4fa5244aa4d8ade55110af0232a27c164c5d870eb75d7db0c50ccfa
MD5 ccfe53cc84933f272e9695d474b52052
SHA1 fddaabfc0c0aa4b975d69fb75f03526941824d16
SHA512 392050664389279b39b8d6e96f39447217565ee908c409ecea02a90f47da1a3f041f55061729598544098ec0b7515e7a8dad0d74ae8b92f259ea339b5b747908
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WC9hOd+E6Dd79WCY+E6Dd79WCy:Jp7Dp7Dp7Dp7z3p7Dp7Dp7Dp7zs
TLSH
T112267B10B7D18035F5B329328ABFD3399539B8715F2586CFE388463E5E71AE0A934B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4168-0-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/4168-8-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/4976-24-0x0000000000640000-0x0000000000661000-memory.dmp

Download

memory/4976-34-0x0000000000640000-0x0000000000661000-memory.dmp

Download