3df9c6e1c6d1983d16b69d86fd3787197c8d8d3ae2f81e8eed2d95dba077ab04

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 05:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_0bb227a275ded6b28370152a6d380482_elex_stop_vidar.exe
Size 28.2MB
Sample260810-f2s5csec53
SHA256 3df9c6e1c6d1983d16b69d86fd3787197c8d8d3ae2f81e8eed2d95dba077ab04
MD5 0bb227a275ded6b28370152a6d380482
SHA1 3b2e388a8fbf7aa39492f6625a69af08a4d2e902
SHA512 cfc76520da9b249291930c6aea1668c457a1142e72aa4eae362199fd5e42a336fb2313d89583d7e6587d8cd5b137cc07c6f5c7d96a2d5710dd7a699ded6652a5
SSDEEP 196608:kFlfFlVFlfFlEFlfFlVFlfFlEFlfFlVFlfFlEFlfFlVFlfFlca:i3Z3E3Z3E3Z3E3Z3B
TLSH
T1AE57F106FD8640B1ED3A61704CE7E27B49317E3AC031CA5BF5C9BB0A7F37A615829616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c652-20.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c652-20.dat	UPX
behavioral2/files/0x000c00000001c652-61.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4084	svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACBAAACCCBCCABABCBABCCAABCBAAAAABCBBACCBCCBCAAABCBACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe"	2026-08-10_0bb227a275ded6b28370152a6d380482_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1332	sc.exe
5888	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4700	cmd.exe
2876	cmd.exe
4728	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_0bb227a275ded6b28370152a6d380482_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4892	2026-08-10_0bb227a275ded6b28370152a6d380482_elex_stop_vidar.exe
4892	2026-08-10_0bb227a275ded6b28370152a6d380482_elex_stop_vidar.exe
4892	2026-08-10_0bb227a275ded6b28370152a6d380482_elex_stop_vidar.exe
4892	2026-08-10_0bb227a275ded6b28370152a6d380482_elex_stop_vidar.exe
4084	svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe
4084	svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	2026-08-10_0bb227a275ded6b28370152a6d380482_elex_stop_vidar.exe
Token: SeDebugPrivilege	4084	svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4700	4892	2026-08-10_0bb227a275ded6b28370152a6d380482_elex_stop_vidar.exe	91
PID 4700 wrote to memory of 4452	4700	cmd.exe	93
PID 4892 wrote to memory of 2876	4892	2026-08-10_0bb227a275ded6b28370152a6d380482_elex_stop_vidar.exe	94
PID 2876 wrote to memory of 5888	2876	cmd.exe	96
PID 4892 wrote to memory of 4728	4892	2026-08-10_0bb227a275ded6b28370152a6d380482_elex_stop_vidar.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-10_0bb227a275ded6b28370152a6d380482_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_0bb227a275ded6b28370152a6d380482_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAAACBCCABCCCBAACACABABABAABBCACCABBCBCAACBACBCBBBBABAABBCABABCAACCBCABBCCCBCABCCBBAAAABCCBACBCBCAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAAACBCCABCCCBAACACABABABAABBCACCABBCBCAACBACBCBBBBABAABBCABABCAACCBCABBCCCBCABCCBBAAAABCCBACBCBCAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABACBBBBCAACBCCABAACAACAACAACBBBBBCBCAAABABBBBACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe" start= auto displayName= "UserDataSvc_CABACBBBBCAACBCCABAACAACAACAACBBBBBCBCAAABABBBBACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABACBBBBCAACBCCABAACAACAACAACBBBBBCBCAAABABBBBACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe" start= auto displayName= "UserDataSvc_CABACBBBBCAACBCCABAACAACAACAACBBBBBCBCAAABABBBBACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABACBBBBCAACBCCABAACAACAACAACBBBBBCBCAAABABBBBACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4728
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABACBBBBCAACBCCABAACAACAACAACBBBBBCBCAAABABBBBACBC"
    3⤵
    - Launches sc.exe
    PID:1332

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe
1⤵
PID:6104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 76acae825bc0feca60cef6ee0dad4e2bec6a51d85a708833ab9eb23b095543c8
MD5 f219d8099dab03ccdd479ae0a04e6ff8
SHA1 527069c9541147e7c9764c0ef61f86030a9aeb30
SHA512 5d2bb11c40ba20fe47fff4dbf580c74a7c7478d961a9e0aa19b466f4ed637e89b815bb67f8b7893170172a71fa7a474fcda2691ee58cfb69df267bcd4371fd80
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f53c06fb1cc735165daf2fc749dd05dd42618d18c735f8c4cb4452771393bf44
MD5 72997c32b116b73bd13b936fd7a06a91
SHA1 79311af4c9f339f0f648c5d9a61775cbd25121e1
SHA512 8dbbaff1f27b8ab11b198a95dfd5c5662892691a4554b077f369c47661c69d809824bdd3f01951a687eb4b55b1dc76529ea8d6a6ade5a8d858c7c90222e7613a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ec6dbd93128ae3ceef1df2d3a8518ebd174b535f5d8dc2231c6aa77b28370512
MD5 37e4c6715f47fa24f97898ddfe4b189a
SHA1 12f72cfbe84e5003fa4704d7ba64cc7bbec7858c
SHA512 047c1935fb16f96a8001ec970f9c4b10e4338ffa966ec336d4a5bfd010b05431517cc451b79b44a10b81427cb2059762340055602e260d23fcad688c239385a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a311b4ec9e8e6d485c9d77a1c232023c5326501f93526c9959435abd067e8eee
MD5 c9ceff086d2d359850e17ca6fd89f863
SHA1 0ce0322fc045911abebc49dd97e92d9560dd4ab1
SHA512 8463c72a7c213b21a7aa89780ae643c993087cc6b6b7017552533ebad3e16c4ec291c1544685f1d9a46a50129171fbc774e4b23bb6bd28c97e2f5a687caaa2cc
MD5 SHA1 SHA512

Submit Download

svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe
Size 28.2MB
SHA256 3df9c6e1c6d1983d16b69d86fd3787197c8d8d3ae2f81e8eed2d95dba077ab04
MD5 0bb227a275ded6b28370152a6d380482
SHA1 3b2e388a8fbf7aa39492f6625a69af08a4d2e902
SHA512 cfc76520da9b249291930c6aea1668c457a1142e72aa4eae362199fd5e42a336fb2313d89583d7e6587d8cd5b137cc07c6f5c7d96a2d5710dd7a699ded6652a5
SSDEEP 196608:kFlfFlVFlfFlEFlfFlVFlfFlEFlfFlVFlfFlEFlfFlVFlfFlca:i3Z3E3Z3E3Z3E3Z3B
TLSH
T1AE57F106FD8640B1ED3A61704CE7E27B49317E3AC031CA5BF5C9BB0A7F37A615829616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABCACBACBBACBCBAAACAABCCACBBBAAACBABBAACBCBBCBCCAAC.exe
Size 4.2MB
SHA256 434f250e17e3a94c9169f61368b62ba738b729e94fd2a6871149c265c3b4a68e
MD5 b7d81258c402d86fd9357bf1c1004cf1
SHA1 8f67d8412fc95d71c4f6839cd05c6907c25b5914
SHA512 2b5a85ecf737d3cfc914fa8aba69016f9430303d35bd2d0150543e33d250aee7efbb351c6f2ab3ad17db4a28304b41cec8108aa1943dd1e86ce13ed5d4cd856c
SSDEEP 49152:U+Ei+Ei+Ei+EEuY5YaRCQxkxydLwQ+Ei+Ei+Ei+EEuY5YaRCQxkxydLw2+Ei+Ei4:kFPdLbFPdLpW
TLSH
T1C916E14AFD4744F1DD2A60700CDBE27F49317E3AC0128EA9FACABB077A37A21541E556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4084-25-0x0000000000130000-0x0000000000151000-memory.dmp

Download

memory/4084-38-0x0000000000130000-0x0000000000151000-memory.dmp

Download

memory/4892-0-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/4892-8-0x0000000000800000-0x0000000000821000-memory.dmp

Download