ab2f154a3e2291c7d1b4e9a2c42436e1157ab81c972bd2eb253075448a86d913

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 18:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_bbc5f3b09b4193417ee3b40cf31c867c_elex_icedid_vidar.exe
Size 1.4MB
Sample260810-wxsk2avdmc
SHA256 ab2f154a3e2291c7d1b4e9a2c42436e1157ab81c972bd2eb253075448a86d913
MD5 bbc5f3b09b4193417ee3b40cf31c867c
SHA1 305023593713970bac5fb7fd3e988df94a4fbe28
SHA512 0e323992ff6da7313a7ec51df84f65edca698ad1688d6db06647f8b7536d66dadda38e4a043bd2197a8e03d77f498309b7646e83760a566407bc68ce5e63972f
SSDEEP 24576:m9+EM01Tiw2Th9+EM01Tiw2Th9+EM01Tiw2TTAhY9:U+EPiw2H+EPiw2H+EPiw2PT
TLSH
T17265A50976ED0474E4B6653449A2866D96B2B851CB33CEDF51408EEEBFE3AD09C34B31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4672	svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe
3924	svchost_CCBBACCAAACAABCCCBCCCCABBAAAABCBBACBBCCBABBCBAAABBBCBBA.exe
5140	svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCACCCCCCCCACAABCBBCCCBBACAACBCBABAACBBAACCCBABCCAACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe"	2026-08-10_bbc5f3b09b4193417ee3b40cf31c867c_elex_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAACCBCBCACBCBCBCAAAAACACABAACBCABACCABABAABBBCAABAABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBACCAAACAABCCCBCCCCABBAAAABCBBACBBCCBABBCBAAABBBCBBA.exe"	svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2340	sc.exe
5720	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3028	cmd.exe
2016	cmd.exe
1340	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_bbc5f3b09b4193417ee3b40cf31c867c_elex_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBACCAAACAABCCCBCCCCABBAAAABCBBACBBCCBABBCBAAABBBCBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4256	2026-08-10_bbc5f3b09b4193417ee3b40cf31c867c_elex_icedid_vidar.exe
4256	2026-08-10_bbc5f3b09b4193417ee3b40cf31c867c_elex_icedid_vidar.exe
4256	2026-08-10_bbc5f3b09b4193417ee3b40cf31c867c_elex_icedid_vidar.exe
4256	2026-08-10_bbc5f3b09b4193417ee3b40cf31c867c_elex_icedid_vidar.exe
4672	svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe
4672	svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe
4672	svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe
4672	svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe
3924	svchost_CCBBACCAAACAABCCCBCCCCABBAAAABCBBACBBCCBABBCBAAABBBCBBA.exe
3924	svchost_CCBBACCAAACAABCCCBCCCCABBAAAABCBBACBBCCBABBCBAAABBBCBBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	2026-08-10_bbc5f3b09b4193417ee3b40cf31c867c_elex_icedid_vidar.exe
Token: SeDebugPrivilege	4672	svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe
Token: SeDebugPrivilege	3924	svchost_CCBBACCAAACAABCCCBCCCCABBAAAABCBBACBBCCBABBCBAAABBBCBBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 3028	4256	2026-08-10_bbc5f3b09b4193417ee3b40cf31c867c_elex_icedid_vidar.exe	92
PID 3028 wrote to memory of 5096	3028	cmd.exe	94
PID 4672 wrote to memory of 4596	4672	svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe	95
PID 4256 wrote to memory of 2016	4256	2026-08-10_bbc5f3b09b4193417ee3b40cf31c867c_elex_icedid_vidar.exe	98
PID 2016 wrote to memory of 2340	2016	cmd.exe	100
PID 4256 wrote to memory of 1340	4256	2026-08-10_bbc5f3b09b4193417ee3b40cf31c867c_elex_icedid_vidar.exe	101
PID 1340 wrote to memory of 5720	1340	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_bbc5f3b09b4193417ee3b40cf31c867c_elex_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_bbc5f3b09b4193417ee3b40cf31c867c_elex_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBCBBCBBBBBCACAACCBBABBCCCBACABBACCBBAAAAACACABAABAAAABBCBBCBACCACCBBCACABBCABABABACCCCACABABACAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBCBBCBBBBBCACAACCBBABBCCCBACABBACCBBAAAAACACABAABAAAABBCBBCBACCACCBBCACABBCABABABACCCCACABABACAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABAABBABAABBACBBCABBCACCACBBBBCABCAACACCBABACCABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe" start= auto displayName= "UserDataSvc_BABAABBABAABBACBBCABBCACCACBBBBCABCAACACCBABACCABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABAABBABAABBACBBCABBCACCACBBBBCABCAACACCBABACCABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe" start= auto displayName= "UserDataSvc_BABAABBABAABBACBBCABBCACCACBBBBCABCAACACCBABACCABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABAABBABAABBACBBCABBCACCACBBBBCABCAACACCBABACCABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABAABBABAABBACBBCABBCACCACBBBBCABCAACACCBABACCABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBACCAAACAABCCCBCCCCABBAAAABCBBACBBCCBABBCBAAABBBCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBACCAAACAABCCCBCCCCABBAAAABCBBACBBCCBABBCBAAABBBCBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe
1⤵
- Executes dropped EXE
PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 59f97d63a0a5bb971035cc90264f5d36cccf8e0756b35803e2401963bce556f1
MD5 9ff8e1c89244652c57df18ee6e5205ac
SHA1 0c249d8d860ef48075bc75a1d6d991c66e60808f
SHA512 7f51e7e228994e5c6943e23300fd4db968d18741119203fda894b7d82389ec412ccf4fcc36d5c1dc5c33614a3b1222dc12388b0f644e3464e8d9506edcb24183
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aa03db512b7399f68ca26a13a209815c693d6ebcfb4b819b525bd7beaf659526
MD5 808fb4d6a746a5da48b3928ddac891e4
SHA1 dbb7e5bbb1e9d373182907ecd97bba1dc01b4f03
SHA512 e27a4e2c3b6e10cfe7bd717e4d5c3e7ddd5b6a3af3b519cd164bdb067a2835f77154e2c7c3e24cd95987131dd8b77be8dbc5b41f74e8b3db351036adce13db30
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6133482236cf272ee08080f6ebee9f0dcc0d7435b7de3eee111cf58383ce3ca9
MD5 b144477d096cca33f2b8c351e7277d6b
SHA1 921eb5785350a2b9519adf826c03bf227d970ad9
SHA512 7f0e0947d0f66d55ae951c3172a330ef5bed832f98d302e9d33e5bae8aa6b2f87a9fac0b67193f29b13cb73d430aa6efce23187cae5c2ade49dc8ceb49a4947f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 24b230bdca87d33137507ef48d46fdddc3ae33a3a0fe299feb2ac1c718005145
MD5 3857b59557675b64064dd235afcff57b
SHA1 1d75b34de22fe37be4f500a325c90b7077db63ca
SHA512 dad57a7a31c1a21e1decdfc42b782373629eb86eb34f362f1786de3e3335210f3367d697cb38bc06d46226561bd713d09818bc9218fd7351c2a99d03ed227886
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7dfc69a63b1080877aee6e0017a85d65c4b2654426d561eba8942dfb24d628e1
MD5 c35c77b2f38088f741f3d0d2896e67ee
SHA1 17a52c635e5533a3d328139b5dd6e8a9eb4396a4
SHA512 74c8d11343b2e72ac0ff7bd2381c1a13780e893dfd86b63f58dd00a1d34491120ba22a9cbaf201123ad9a0db9392984f9d123f7765c480d1492e23e1f36007cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 70a5fe9d327c5b41f9b24ac27ac645d824ade56ebe875de9dfb9a9c3c44f074f
MD5 90385c744089696bada65ac98b0f7589
SHA1 b5d6035e9dd2516d6762fbe175b6e3d310a819bf
SHA512 b90fcbb9ec77a521a9f6b43f176106ecefdf72811c231647ec6bcdc605186737a395d388b3bfc197b6726ca3cb4241d1b74eaf8796cf5845fee9843733dc3a9b
MD5 SHA1 SHA512

Submit Download

svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBBBBCACBABACBBCAABCACBACBCCBACCAACBBABBCACABBAABB.exe
Size 1.4MB
SHA256 ab2f154a3e2291c7d1b4e9a2c42436e1157ab81c972bd2eb253075448a86d913
MD5 bbc5f3b09b4193417ee3b40cf31c867c
SHA1 305023593713970bac5fb7fd3e988df94a4fbe28
SHA512 0e323992ff6da7313a7ec51df84f65edca698ad1688d6db06647f8b7536d66dadda38e4a043bd2197a8e03d77f498309b7646e83760a566407bc68ce5e63972f
SSDEEP 24576:m9+EM01Tiw2Th9+EM01Tiw2Th9+EM01Tiw2TTAhY9:U+EPiw2H+EPiw2H+EPiw2PT
TLSH
T17265A50976ED0474E4B6653449A2866D96B2B851CB33CEDF51408EEEBFE3AD09C34B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 26123f68c2d954248fc99af88a634b1edea84ab5627b29b624f937eceb7fcd0e
MD5 670796dca421a1cadd49af0d05cd65ea
SHA1 f6d3d42f04074a83aec91f8f8cf972a4a4eb1240
SHA512 44e99262ae5d7777f04c4cbda5cdcf3910277eeca9890d4c5df07973a021ec7abb7d5fcf5093a8251cba588dfcdf876a74bc444a87774e4bcee8e7ac26739e7b
TLSH
T1E21131A1D4A9DCA7E972688B662DCFD30CF437EF585CAA4433089128E7C5D328D574E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3924-70-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/4256-7-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/4256-0-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/4672-33-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/4672-23-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/5140-72-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download