259f5f856fb703d99b2f9a0df7cfe7c3027cb12044d7ea416754292edfbdce0e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
Size 20.2MB
Sample260810-edca9sam91
SHA256 259f5f856fb703d99b2f9a0df7cfe7c3027cb12044d7ea416754292edfbdce0e
MD5 e8cc5c9cc4d21c92f0988acc6148a656
SHA1 6b75b68fd913c5bae42bee452149a16be039f30f
SHA512 7cdfcfe6ceab2e4bb63bee78f9842ea7642b612d93e18b5ebb3d275337882bba82ebad86e97571f72177455554317b3ba8d7bde430b67c87943fc08465549d97
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLcR+ES+ES+EWLE+ES+EW5+ES+ES+ES+Ey:1p7r
TLSH
T1D1274B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3140	svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe
3832	svchost_AAACCABBBCCBCBBCABACCBCABCCAABBACBBAAACCABACABCCACCACBA.exe
2120	svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABAACBBCACBCACABBCBCCCBABCCCBBAACCAABABCACAABAABCAACAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe"	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABACBAACAACAACCBCCABCBCBACAABAABCCABCAABBCAACCABBACBBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACCABBBCCBCBBCABACCBCABCCAABBACBBAAACCABACABCCACCACBA.exe"	svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2152	sc.exe
1768	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5052	cmd.exe
628	cmd.exe
4756	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACCABBBCCBCBBCABACCBCABCCAABBACBBAAACCABACABCCACCACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2904	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3948	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
3948	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
3948	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
3948	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
3140	svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe
3140	svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe
3140	svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe
3140	svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe
3832	svchost_AAACCABBBCCBCBBCABACCBCABCCAABBACBBAAACCABACABCCACCACBA.exe
3832	svchost_AAACCABBBCCBCBBCABACCBCABCCAABBACBBAAACCABACABCCACCACBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3948	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
Token: SeDebugPrivilege	3140	svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe
Token: SeDebugPrivilege	3832	svchost_AAACCABBBCCBCBBCABACCBCABCCAABBACBBAAACCABACABCCACCACBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4856	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 628	3948	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe	95
PID 628 wrote to memory of 2904	628	cmd.exe	97
PID 3140 wrote to memory of 3348	3140	svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe	98
PID 3348 wrote to memory of 4488	3348	notepad.exe	99
PID 3948 wrote to memory of 4756	3948	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe	108
PID 4756 wrote to memory of 2152	4756	cmd.exe	111
PID 3948 wrote to memory of 5052	3948	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe	112
PID 5052 wrote to memory of 1768	5052	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABACCBCAABBBCCBCACBCBCCACACBABACCBAABBBBABBBCBCBACBACBBBBCBACACACAACAABBAACACABCAABABACCBCCAACCCBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABACCBCAABBBCCBCACBCBCCACACBABACCBAABBBBABBBCBCBACBACBBBBCBACACACAACAABBAACACABCAABABACCBCCAACCCBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBBCCCACAAACACCACCABBAACCCABCBBCAAABCCACAAABABCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe" start= auto displayName= "UserDataSvc_BBBBBCCCACAAACACCACCABBAACCCABCBBCAAABCCACAAABABCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBBBCCCACAAACACCACCABBAACCCABCBBCAAABCCACAAABABCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe" start= auto displayName= "UserDataSvc_BBBBBCCCACAAACACCACCABBAACCCABCBBCAAABCCACAAABABCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBBCCCACAAACACCACCABBAACCCABCBBCAAABCCACAAABABCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBBBCCCACAAACACCACCABBAACCCABCBBCAAABCCACAAABABCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4488

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCABBBCCBCBBCABACCBCABCCAABBACBBAAACCABACABCCACCACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCABBBCCBCBBCABACCBCABCCAABBACBBAAACCABACABCCACCACBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe
1⤵
- Executes dropped EXE
PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c849b2171a48b5675fe68620d346393790f8a868ab135edb01ec8e80f57ab52b
MD5 840af5bc60a161bb6c4bdc4391a5070e
SHA1 6753e7e2142144bf92fd26c518a04d505be257e4
SHA512 e89b7622696d717b1ce27ce6bceff52344ddcdeb9903937a3b93429271935ea3397573995a123ea215009c9a4b837b8e17f74e4529c28e93ca2fc9cfd19b672a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 666f26147b119e36954f313520bb91d72ae7668decccc076c509af3802a6c3a0
MD5 2c46fd97625a81ad26fe495b7f0129ed
SHA1 804900b3dc2fa96c5e2779efb962e322399e1523
SHA512 86cb706d03d48746f40211b94f783c5b66b3a24f2f856983475af03bef87f952a6387f93c9d25cc3bb9f578671dc96480e499334db82dc1223985c8754afaee0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1df5c3ab19d577e89309a78e655284a1d4d033ff31083c63e1b18a0e82d15358
MD5 873040f7ce2254435417949ee7742bcf
SHA1 d51a2520cd2b8045805b7f89d9a6b946f93d3bbc
SHA512 bb4f36c7be4431656a6b976e9df4371ac5dfe9ce38bb769864b137d1f57cedf392ef4ab0adc7eba7b35dec77da36e5094743ec8536a7d883138f90f91dc88245
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2c9ab76c06272bb8b09cc43a0d1a7403ecc9f6c34d05ceb39588597b00597ec0
MD5 49ecb1c06478ad3b71d299fe99eca39d
SHA1 74441f30c05b77b886fba86a888fe731809412d1
SHA512 6114ad3e62868ca7713bf6078a99d6fcae7fd05fb9362dc01694831bc94fa6613e2d707b6c30f8eadbe4dfa6734e73c61a4af68e33d4cebe535b6e639bdc14a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ef2dfbce1a5337dad340dc4d09c8142dc99b5317e7bf041e716b461fda89d84a
MD5 9cd01caed9a47caff3fe3c5671169e03
SHA1 50363337cbe39c01ea3007a6a60e867606d5232c
SHA512 05ce19e964b16c917d12a122490d0dd62230e5c7295d39e4c5ba70ebb26c69fcd33b077211c7d894e8424555c9817624b62797fb9d1709e059c5477a0752f3cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3cd4e7ae000618e724ed11d60cc9e21d0e56b44c5c9c80c1c0475668a90bf29a
MD5 62907860db831a5136ae5f7fefbeef39
SHA1 c2cf2e0471c944146e6e0e002bcb513dbd1a40b4
SHA512 ddf0bc33463ce30bd33490b923d186de81ea1ed43aac991f663cb91830b00292c6e80fb57cb6e907db0ece451e0e9d2b7f09ef274accaffae80522000829fa90
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fe9a1be0fc05b49f8a6bf114cfa7edaed92da7a4b0865dec10cf6f167be15dd9
MD5 b8c2e0cc875801c63ddabd31e831b71d
SHA1 a48d7401a86de98c302306d36014604956d15bdb
SHA512 1518f0fc6b1c88951308652fe0e4121336dda1bfab1af5a1b712836aecafc109472ab196d1d5e6753eaefb8dc7efb3c0c66b3b7379c1ccbe7bc846af7cb4f7db
MD5 SHA1 SHA512

Submit Download

svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCCCAABBACBCACBABBCABCABBCCBAACCCAABCCACBAAACBCBABA.exe
Size 20.2MB
SHA256 259f5f856fb703d99b2f9a0df7cfe7c3027cb12044d7ea416754292edfbdce0e
MD5 e8cc5c9cc4d21c92f0988acc6148a656
SHA1 6b75b68fd913c5bae42bee452149a16be039f30f
SHA512 7cdfcfe6ceab2e4bb63bee78f9842ea7642b612d93e18b5ebb3d275337882bba82ebad86e97571f72177455554317b3ba8d7bde430b67c87943fc08465549d97
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLcR+ES+ES+EWLE+ES+EW5+ES+ES+ES+Ey:1p7r
TLSH
T1D1274B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 c79b3512a252593133902eb6f47951b1656cc2c121af27979358ea1830fcb72e
MD5 faccf8d84fce386c6f7547baa0579481
SHA1 2f4e8cac8a44bf5e19a4d94c6a58a06141eee670
SHA512 467db5fe2e03ad282584cd496b49a858fb7060f5c6bfd330f55b930840339dd76811c8b76d5431207fea1757ae8a649fac7e42b5afb470567ef25d7669884cb7
TLSH
T1D511C8A0D4B9DC17E9226DCB611EDA920CA9779FB8185A24234C46187F99C33CD614D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3140-37-0x0000000000FE0000-0x0000000001001000-memory.dmp

Download

memory/3348-60-0x0000000005610000-0x0000000005611000-memory.dmp

Download

memory/3832-77-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/3948-0-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/3948-8-0x0000000000180000-0x00000000001A1000-memory.dmp

Download