7f371ed31f0dfa6eecd1cd2c31c8e7c8cd7de6aafdad8547281fe458c87a7977

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_2cb0c66fc0bf6903096ed08631575a87_elex_stop_vidar.exe
Size 9.0MB
Sample260810-dct91shr3t
SHA256 7f371ed31f0dfa6eecd1cd2c31c8e7c8cd7de6aafdad8547281fe458c87a7977
MD5 2cb0c66fc0bf6903096ed08631575a87
SHA1 6bf361154718ae2af2cfd2001ca1c2eb9ac7e7c5
SHA512 14d8dbc0d6c5b92e104142dac15f1b63bf61ad2259716e188e23ccc466a81cc1dc3c1d66593f88f2d4b255cca8ce9383f38b8e1f9630deb25e6247e0d7e5e039
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7zp7Dp7Dp7Dp7Dp7V1/tr37wx:vBBBBxBBBBRS
TLSH
T14E969D1177E08031F0B790768ABBE726D9357C694B3895CF9788066F1E737E0AA39712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6016	svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe
3564	svchost_CABBACBBAACCACBACAACCCABCBACBABBBAABCAABCAAACBBCBBBBBCC.exe
1232	svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAACBBCBCACBBABACAAABACBACCCBCCBAABBAABCBBABCACBCAACBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe"	2026-08-10_2cb0c66fc0bf6903096ed08631575a87_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACCBBACACBCAACACBACCABAACBCACBCCCCBCABBCCBCBCAAACCCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBACBBAACCACBACAACCCABCBACBABBBAABCAABCAAACBBCBBBBBCC.exe"	svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3704	sc.exe
4340	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4160	cmd.exe
4232	cmd.exe
3492	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_2cb0c66fc0bf6903096ed08631575a87_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBACBBAACCACBACAACCCABCBACBABBBAABCAABCAAACBBCBBBBBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2920	2026-08-10_2cb0c66fc0bf6903096ed08631575a87_elex_stop_vidar.exe
2920	2026-08-10_2cb0c66fc0bf6903096ed08631575a87_elex_stop_vidar.exe
2920	2026-08-10_2cb0c66fc0bf6903096ed08631575a87_elex_stop_vidar.exe
2920	2026-08-10_2cb0c66fc0bf6903096ed08631575a87_elex_stop_vidar.exe
6016	svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe
6016	svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe
6016	svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe
6016	svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe
3564	svchost_CABBACBBAACCACBACAACCCABCBACBABBBAABCAABCAAACBBCBBBBBCC.exe
3564	svchost_CABBACBBAACCACBACAACCCABCBACBABBBAABCAABCAAACBBCBBBBBCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	2026-08-10_2cb0c66fc0bf6903096ed08631575a87_elex_stop_vidar.exe
Token: SeDebugPrivilege	6016	svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe
Token: SeDebugPrivilege	3564	svchost_CABBACBBAACCACBACAACCCABCBACBABBBAABCAABCAAACBBCBBBBBCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 4160	2920	2026-08-10_2cb0c66fc0bf6903096ed08631575a87_elex_stop_vidar.exe	92
PID 4160 wrote to memory of 2784	4160	cmd.exe	94
PID 6016 wrote to memory of 1808	6016	svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe	95
PID 2920 wrote to memory of 4232	2920	2026-08-10_2cb0c66fc0bf6903096ed08631575a87_elex_stop_vidar.exe	98
PID 4232 wrote to memory of 4340	4232	cmd.exe	100
PID 2920 wrote to memory of 3492	2920	2026-08-10_2cb0c66fc0bf6903096ed08631575a87_elex_stop_vidar.exe	101
PID 3492 wrote to memory of 3704	3492	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_2cb0c66fc0bf6903096ed08631575a87_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_2cb0c66fc0bf6903096ed08631575a87_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACABCAACBACBCCCACCBBBACCACACACBCABBCBBCACACABCBCCBAAABCBABAACBCAAACCCAACABCCABACCBBCAAAABCCCBABCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACABCAACBACBCCCACCBBBACCACACACBCABBCBBCACACABCBCCBAAABCBABAACBCAAACCCAACABCCABACCBBCAAAABCCCBABCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCCACACBBBBCBBABACCCABCBBACACBACABABBBCBACCBCCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe" start= auto displayName= "UserDataSvc_AACCCACACBBBBCBBABACCCABCBBACACBACABABBBCBACCBCCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCCACACBBBBCBBABACCCABCBBACACBACABABBBCBACCBCCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe" start= auto displayName= "UserDataSvc_AACCCACACBBBBCBBABACCCABCBBACACBACABABBBCBACCBCCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCCACACBBBBCBBABACCCABCBBACACBACABABBBCBACCBCCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCCACACBBBBCBBABACCCABCBBACACBACABABBBCBACCBCCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1808

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBAACCACBACAACCCABCBACBABBBAABCAABCAAACBBCBBBBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBAACCACBACAACCCABCBACBABBBAABCAABCAAACBBCBBBBBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe
1⤵
- Executes dropped EXE
PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b196adf478d61f41e53ac7880800e07df59708694eb9edba0bbce8a17af86d6e
MD5 334da92d90e3953fc9cde60a1c264005
SHA1 9713eaae4ce9ec2d7a786120ddd7ac38429fcd39
SHA512 5a2a5ca41fd73eb4b48dbf42ce9cc9c969f863056628c93b3a4de9dea3c3a40ea14a469972951183923dc037fa5bb0221e2e614223b415dd577c5b7888804d88
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 128d88b8955e3d55afc59a67b01163037ecd8ccab35ebf3487a429024b5eca5e
MD5 564c0ed804d3acc1d5a2730ee0886de4
SHA1 0c2cae20d2dc1b2a0d205dd3f2a006ec651b2a8b
SHA512 7157e9fb12ce57ffb6facba07ac2fe491823c381a4f3f33ea2bf5b6d9af3601243c05bfcf2738f3031fa72f9179d40dfb5ff94294a778a9df8bd9617efdfe871
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0248e18f4a7d2c8be8bd2cfef118b2cc2fa516893d280c5ba1511e2b5fbcadb9
MD5 67085d5433260656f57c71bc8c53f135
SHA1 53aaec269abf0d6090670b8ab70c8faf9dc6ccf2
SHA512 bc7607d76bca574b95b6577eeae6ca639dbb3490d78dc52bb504467cb1c3186cc41aa12f92cae1a55f1016a3d07f0637ca081f2caa3ab26b364732f921c2b855
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0daf881ecfef6241733116ef81a8efa54c709b60e26236513aa20fc61df1fdda
MD5 81f64524337a45918565d16e7f3bc712
SHA1 418572fc7dd94a166415064dc82f112cdfd966db
SHA512 973f812d7cdfbdd62dc04c96a7e4f9d1182cdc0c1974db0ee4b88157562e64e44bbf55d7609fb2fc786f958186d14f4042632e178b64797f599861818530b7a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a608370b858051070337aebffaca06bdd236b037ea2fcff3d7e0f09a8b0792f6
MD5 ef13bf06100fa0b12a7a714e324677f8
SHA1 d3cd833f54f013e3b989a64035148dee54c3531a
SHA512 08b0164434fdac302a53bf9f4c476e6964a67789583ede5fc591298cbc65537b507b95c9a85f7b9d122105bd69dfc16466d57a685bc2542eb6a5d671717cc283
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 166d0e7f0edc79f229d1a09a36c211af34a42d14ce5f01f110ee67b245b97d3e
MD5 0c9f54c7d852ae864856f27fe7e6f8b8
SHA1 980e556aad0eccc0af29586bcdcfefebdee93bf9
SHA512 3e564198efb75f4e309deea9fbd8e5bc27ab0cb6c2c2f6ff45113890d3b6039fed395c67a56f3c1a6ea19cea8653b08e6d9d9ad056db15569a077173cc8a533b
MD5 SHA1 SHA512

Submit Download

svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAABCAABCBCABCCCCCABBCAACBBBABCBBACCBCBACCBABAABAAB.exe
Size 9.0MB
SHA256 7f371ed31f0dfa6eecd1cd2c31c8e7c8cd7de6aafdad8547281fe458c87a7977
MD5 2cb0c66fc0bf6903096ed08631575a87
SHA1 6bf361154718ae2af2cfd2001ca1c2eb9ac7e7c5
SHA512 14d8dbc0d6c5b92e104142dac15f1b63bf61ad2259716e188e23ccc466a81cc1dc3c1d66593f88f2d4b255cca8ce9383f38b8e1f9630deb25e6247e0d7e5e039
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7zp7Dp7Dp7Dp7Dp7V1/tr37wx:vBBBBxBBBBRS
TLSH
T14E969D1177E08031F0B790768ABBE726D9357C694B3895CF9788066F1E737E0AA39712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 fecab78db12ffd168167fb44fa46b895e2e3a21802b4975740217f6040221574
MD5 33527adde76d7de6e9dea1bd99661a14
SHA1 a108c9c6a42630c92aa74e1f8d1fbabf2eccdda2
SHA512 605313aadce32e19087faade9993e2e1ad5e3a7d4b688b115c08fc31b333cf9cb3f02652f57a9e0f2b321c7a57804d85cac5d67667d4b4528919c69b18ec5f32
TLSH
T17E11C450A4B9D873FC32ACCF6B19DAE30CE8368FA81C6E145349421CAA99C34CE550E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1232-81-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/2920-0-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/2920-7-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/3564-79-0x00000000004B0000-0x00000000004D1000-memory.dmp

Download

memory/6016-33-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/6016-23-0x0000000000470000-0x0000000000491000-memory.dmp

Download