259f5f856fb703d99b2f9a0df7cfe7c3027cb12044d7ea416754292edfbdce0e

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
Size 20.2MB
Sample260810-edca9sam91
SHA256 259f5f856fb703d99b2f9a0df7cfe7c3027cb12044d7ea416754292edfbdce0e
MD5 e8cc5c9cc4d21c92f0988acc6148a656
SHA1 6b75b68fd913c5bae42bee452149a16be039f30f
SHA512 7cdfcfe6ceab2e4bb63bee78f9842ea7642b612d93e18b5ebb3d275337882bba82ebad86e97571f72177455554317b3ba8d7bde430b67c87943fc08465549d97
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLcR+ES+ES+EWLE+ES+EW5+ES+ES+ES+Ey:1p7r
TLSH
T1D1274B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2784	svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe
4328	svchost_BCACBAAABCCAAABACCCCACBCBBBCBCACACACABAABCCAACAACABCCCB.exe
5104	svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCCBCAAABBBCABAAABACACACABBBAAAACCCAACBACCACBCCBCACCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe"	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBBCBCBBABBABBBCACBCAABBABAACCBCABCCAACBCACABBCBCBCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACBAAABCCAAABACCCCACBCBBBCBCACACACABAABCCAACAACABCCCB.exe"	svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5840	sc.exe
5836	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4224	cmd.exe
2872	cmd.exe
2028	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACBAAABCCAAABACCCCACBCBBBCBCACACACABAABCCAACAACABCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1096	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
1096	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
1096	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
1096	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
2784	svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe
2784	svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe
2784	svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe
2784	svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1096	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
Token: SeDebugPrivilege	2784	svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 4224	1096	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe	95
PID 4224 wrote to memory of 2376	4224	cmd.exe	97
PID 2784 wrote to memory of 3392	2784	svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe	99
PID 1096 wrote to memory of 2872	1096	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe	102
PID 2872 wrote to memory of 5840	2872	cmd.exe	104
PID 1096 wrote to memory of 2028	1096	2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe	105
PID 2028 wrote to memory of 5836	2028	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e8cc5c9cc4d21c92f0988acc6148a656_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACBBBCAAAACCBCCCBBAAABCCABAABBABBCBBBBABCCACACCABCABCAABACCAABBCBBCAAACACABBCCBCCCBAABCACCACCCAABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACBBBCAAAACCBCCCBBAAABCCABAABBABBCBBBBABCCACACCABCABCAABACCAABBCBBCAAACACABBCCBCCCBAABCACCACCCAABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCCBCCBBACBCAAAAAACBBCAACAAABCBCCCCCAACCCACCACBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe" start= auto displayName= "UserDataSvc_AABCCBCCBBACBCAAAAAACBBCAACAAABCBCCCCCAACCCACCACBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCCBCCBBACBCAAAAAACBBCAACAAABCBCCCCCAACCCACCACBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe" start= auto displayName= "UserDataSvc_AABCCBCCBBACBCAAAAAACBBCAACAAABCBCCCCCAACCCACCACBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCCBCCBBACBCAAAAAACBBCAACAAABCBCCCCCAACCCACCACBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCCBCCBBACBCAAAAAACBBCAACAAABCBCCCCCAACCCACCACBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5836

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBAAABCCAAABACCCCACBCBBBCBCACACACABAABCCAACAACABCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBAAABCCAAABACCCCACBCBBBCBCACACACABAABCCAACAACABCCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4328

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe
1⤵
- Executes dropped EXE
PID:5104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SuspendRename.exe

Path C:\Users\Admin\Desktop\SuspendRename.exe
Size 41.3MB
SHA256 5dfd1098dc031ec68d39cf218f54f91f621d6e9e6ed4ab63e36d312d8309e10a
MD5 7bd99780206799577465a3c7ee1549cc
SHA1 b7fefbe2c7074538943ade181b004bc70cd9b285
SHA512 fba0161053b07e3e1ffac55f0d3eb0a2508a9d8b7b71933e2c64bd62cd8d44272d2d33e2b77b9fab918b1e1b5d7fe040dce1846ae9e7db9c457319229eb08d8c
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLcR+ES+ES+EWLE+ES+EW5+ES+ES+ES+E6:1p75p7FD9P8dm
TLSH
T175975B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8bb7d7c07c68b9860b8cca24f74a7cf4a0cd211ee0db3f05e86d53cfab4e6b90
MD5 4398f14dfce97a88da19d2f4d5d1a6e3
SHA1 0fcfab40944aa9ac511ea5655d92bc419264e5f7
SHA512 1ef0045880b5000d5fbd683f6914b9a4e3232724f39be1ffe4a3e5f348996133a6d3315009a1101b521e08b85cb5b27e1d053fdc58cb464f2b244033c6b4382f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 02083e1bc668389480e9a625c0dc7447508a183707e0cf0c767cd54bdf093d24
MD5 4aaf8105b598070cca6631e72587eb80
SHA1 e9f42c42387622f90213b423e9382a964327b642
SHA512 dafa30128b9a39a7d62a5474c6d3fcd4a634a67ca2a2faba02e52ef4b9eb438c5caa77fc1eda8d80c8bfba91ab8f85199d340cdc1712cd84465f196ed0b483c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a929057095c930dc5710e9925a5dd0381c61f5741d77b94d5fa421eeb9a74967
MD5 655557674e3e8c8d42dca98eb4e6a67d
SHA1 4960ccef15b520b0af420b1fc611c0368aecda2f
SHA512 0a7997fc5851f575f433c8438e30d8ed8c7c097a854ec3b42864461d8e9bfc9512b6dc25464da3c0294576b0ed5260e14b8e680060eef4620ce6cb57b6102275
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9bc494cab4c66bdd7c755469d1b724d48c89075c998968fcfc08567747c94884
MD5 0684ffce12e75cd4bce7ce174e3dd0cc
SHA1 25ddf6a40161963da3684f0dcae435ef14f2c992
SHA512 1c4bd5a3d6228495a85ec3dcc96854281497f79a90b07abf8d4095b0b1c1d4b4ed9f09996b07af14cc3a216b8bbac15b77e35143555a133d1616dbecba1e9d0f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b237a222026e129bcb6c946e32532327539f567ae347d900ddedd7fd363c3695
MD5 e8ae06b15925c75ae9aab47e8cdbaa5b
SHA1 0417519f55282b85871d3fd163183555d01b0784
SHA512 917cb66e3aded615f4b1d903052c8530b15e9ef8f1e783b3ab626e39a3986f6e4ecc9c9bcc4ca99a01443b14557ca9aff9db31a029b04af330cb7c829e5f2aec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 514b3d2a8e732a50da6993f8c7d6142292e495474ff2891801e9845640e72611
MD5 927c54f14829c11620ba2f380cbe1507
SHA1 d380589cfce821674973bd3e317c4a6735cecc9f
SHA512 3c6e237c6f77d552891af100634fa6b855f0979bd7791ba1585a29b493f7e87ed675bd8d583841fd9951f1604b69f5588c0bc2d1a4cb5d632fa86598e0961fa8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c483654fe10a9729858246b38c76b8c5081d09a3d96d9d295a716d08650c84f5
MD5 5e92d0cc24309f3a5198ac3bd544873d
SHA1 048ef12a7165e48aef18b359beb2e02aa4b1386c
SHA512 4daedd1e903cacf6c99319c80480fdf7cbcb3a3a76e98a4a7f1308c344635d6ff8d7814d5d74799f3254d9b3f9ec47466e67fd5e019e523d578b33ff0fb791ad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 387529b5b5d244346e0d9b0d803b92b3a54205921782bfe4e3593889a312935d
MD5 5d3e17b73b19a57c35a513fc170c0a32
SHA1 d2daa0bfc63b42d30f1af379f63bad50be0db128
SHA512 56749be203c562524182bc9994e70f4dc608f61e0a3ee9abc1c673b234b6e3b1c32c5823737738569050146273a19f9fede76bad5795b06798912afe3e046f11
MD5 SHA1 SHA512

Submit Download

svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAACCBACBAABCBBBBBCCBCCBABACCACABBABAACCCBAAACBCAA.exe
Size 20.2MB
SHA256 259f5f856fb703d99b2f9a0df7cfe7c3027cb12044d7ea416754292edfbdce0e
MD5 e8cc5c9cc4d21c92f0988acc6148a656
SHA1 6b75b68fd913c5bae42bee452149a16be039f30f
SHA512 7cdfcfe6ceab2e4bb63bee78f9842ea7642b612d93e18b5ebb3d275337882bba82ebad86e97571f72177455554317b3ba8d7bde430b67c87943fc08465549d97
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLcR+ES+ES+EWLE+ES+EW5+ES+ES+ES+Ey:1p7r
TLSH
T1D1274B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-29-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/1096-15-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/1096-62-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/1096-0-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/1096-116-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/1096-88-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/2784-61-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/2784-110-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/2784-87-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/4328-101-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/5104-119-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download