d85461c9d4298e6014221afeaf0ec3789be520062eef34b913bac981ae9adc94

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_17377b40a1f5d9a1d0b31f8ec52484f3_elex_stop_vidar.exe
Size 4.7MB
Sample260810-dhefraaj3w
SHA256 d85461c9d4298e6014221afeaf0ec3789be520062eef34b913bac981ae9adc94
MD5 17377b40a1f5d9a1d0b31f8ec52484f3
SHA1 804adf7eb296fbacbdfe9fee95fef83c14b45385
SHA512 0df116bec1da0c689323e1e375237a3e3ba1d97823fedf4dca180454fc0e2bf6cbca631d0e5e015ea88e091d8b1b5fde213c563600c9581c71ce058cbacb523d
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WC9hOd+E6Dd79WCY+E6Dd79WCX:Jp7Dp7Dp7Dp7z3p7Dp7Dp7Dp7zJ
TLSH
T1CC367C10B7D18035F5B319328ABFD3399539B8315F2586CFE388463E5E72AE1A934B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1968	svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe
2812	svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe
5840	svchost_BCCBBBAAABCCAACACCCCCAABBCCAABCCACCCCCCCAABAAABCAACCBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCAABABBBBAACCBCCCCBCBBABBCAABCCBBBBBBAAACBABCCCBBBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe"	2026-08-10_17377b40a1f5d9a1d0b31f8ec52484f3_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCCAABCBABBAABCBBCAABCBACCCBBBCBCABBBABAABBBBACCACACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBBBAAABCCAACACCCCCAABBCCAABCCACCCCCCCAABAAABCAACCBBB.exe"	svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4344	sc.exe
3996	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
960	cmd.exe
2136	cmd.exe
2000	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_17377b40a1f5d9a1d0b31f8ec52484f3_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBBAAABCCAACACCCCCAABBCCAABCCACCCCCCCAABAAABCAACCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4132	2026-08-10_17377b40a1f5d9a1d0b31f8ec52484f3_elex_stop_vidar.exe
4132	2026-08-10_17377b40a1f5d9a1d0b31f8ec52484f3_elex_stop_vidar.exe
4132	2026-08-10_17377b40a1f5d9a1d0b31f8ec52484f3_elex_stop_vidar.exe
4132	2026-08-10_17377b40a1f5d9a1d0b31f8ec52484f3_elex_stop_vidar.exe
1968	svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe
1968	svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe
1968	svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe
1968	svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	2026-08-10_17377b40a1f5d9a1d0b31f8ec52484f3_elex_stop_vidar.exe
Token: SeDebugPrivilege	1968	svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 2000	4132	2026-08-10_17377b40a1f5d9a1d0b31f8ec52484f3_elex_stop_vidar.exe	92
PID 2000 wrote to memory of 5532	2000	cmd.exe	94
PID 1968 wrote to memory of 3936	1968	svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe	95
PID 4132 wrote to memory of 960	4132	2026-08-10_17377b40a1f5d9a1d0b31f8ec52484f3_elex_stop_vidar.exe	96
PID 960 wrote to memory of 4344	960	cmd.exe	98
PID 4132 wrote to memory of 2136	4132	2026-08-10_17377b40a1f5d9a1d0b31f8ec52484f3_elex_stop_vidar.exe	99
PID 2136 wrote to memory of 3996	2136	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-10_17377b40a1f5d9a1d0b31f8ec52484f3_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_17377b40a1f5d9a1d0b31f8ec52484f3_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBAABABABBCCCCBCACBCCACBCCACCBCAACABCACCACCAACAABACCBCBAABAACACBBCCBCBBABCACCBCABBABBBAAACACCAABCCBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBAABABABBCCCCBCACBCCACBCCACCBCAACABCACCACCAACAABACCBCBAABAACACBBCCBCBBABCACCBCABBABBBAAACACCAABCCBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBCBAABBCABCBBBBAAACAABBBBCABACCCACACBCCBCABBAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe" start= auto displayName= "UserDataSvc_AACBCBAABBCABCBBBBAAACAABBBBCABACCCACACBCCBCABBAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBCBAABBCABCBBBBAAACAABBBBCABACCCACACBCCBCABBAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe" start= auto displayName= "UserDataSvc_AACBCBAABBCABCBBBBAAACAABBBBCABACCCACACBCCBCABBAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBCBAABBCABCBBBBAAACAABBBBCABACCCACACBCCBCABBAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBCBAABBCABCBBBBAAACAABBBBCABACCCACACBCCBCABBAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe
1⤵
- Executes dropped EXE
PID:2812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBAAABCCAACACCCCCAABBCCAABCCACCCCCCCAABAAABCAACCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBAAABCCAACACCCCCAABBCCAABCCACCCCCCCAABAAABCAACCBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 57acebc16d52b045019bdeca22291d6efe3e9a0a323e7603175ad96df2f4a6ee
MD5 4364ddfc91d464d61224986ecf9c0cdd
SHA1 1e3b7df6884200c400fd83faa6c5dd608a6f80a7
SHA512 cc5c37d1237604fbbad1c6f28d5a7d15f5811506628b48cbd1d0eb5734270895f69b4f644503d5f2ad041c85f6ace462dd158631e8ca653915045d616e3b05ed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9fce8d661a04128b26bd429301ba98e2a29e78bafceaaecbe88c353594062276
MD5 189e2efa2f821b32debcafccf0faeff8
SHA1 8dd4f51da7158b1e7cc856861b9ae916b17faa0f
SHA512 843b0544f7d775ee5cfee3ca47329f78a7af9e9c8a9031f3988fcab35ff3c4d9638beed5879182686ce4d91d93cf63db6ca5f9f865cf875138bc6f859118f1cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 47b1e892a9c4ee9bf9652f21502c1a0cbf6102559839c3da51e1853f8ace4ea8
MD5 ecc28e63baa7bd051accb8b72c64f29b
SHA1 4f6ede27f8af14d06d7a2357e4604984d9879f03
SHA512 1cca352cdba052c429110e71b81431d7f7dd88ea17c198d51e75ec8872888c4e8c5931cf71c1335593dbe3b7498d598e980a623bedada3ffe7cca72b6e5f3a86
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 59ea41a3a57b2e034bd6fe0ddf4ba070ae19864c156784afd09aef09fb2290b6
MD5 5c8a7dec96bfec72a8da8e46b9e9205e
SHA1 b6fe2b8629b0423dd7805f2d3d3870a1f3aa5006
SHA512 a863e3d1bbf4c8db87348ebf3097a180dc92ce9201532cb65f20b4bf6797743a4b6d0cf744513d4cb5b9446706d39490aa0bbb4c026cbd1dd989a45f79887e85
MD5 SHA1 SHA512

Submit Download

svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAACCCACBCBCBABAABCACBCCCBCCBBAACBBCCCBBACAABCCB.exe
Size 4.7MB
SHA256 d85461c9d4298e6014221afeaf0ec3789be520062eef34b913bac981ae9adc94
MD5 17377b40a1f5d9a1d0b31f8ec52484f3
SHA1 804adf7eb296fbacbdfe9fee95fef83c14b45385
SHA512 0df116bec1da0c689323e1e375237a3e3ba1d97823fedf4dca180454fc0e2bf6cbca631d0e5e015ea88e091d8b1b5fde213c563600c9581c71ce058cbacb523d
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WC9hOd+E6Dd79WCY+E6Dd79WCX:Jp7Dp7Dp7Dp7z3p7Dp7Dp7Dp7zJ
TLSH
T1CC367C10B7D18035F5B319328ABFD3399539B8315F2586CFE388463E5E72AE1A934B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1968-24-0x0000000000D70000-0x0000000000D91000-memory.dmp

Download

memory/1968-37-0x0000000000D70000-0x0000000000D91000-memory.dmp

Download

memory/4132-0-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/4132-8-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download