c9082279ba0695977dec79afb798a148335504f777624201f7ac1e8d1f597595

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_bc110654618720374baeba20b4b69f09_elex_stop_vidar.exe
Size 38.6MB
Sample260811-bbt7hssdrb
SHA256 c9082279ba0695977dec79afb798a148335504f777624201f7ac1e8d1f597595
MD5 bc110654618720374baeba20b4b69f09
SHA1 0f32cf398cdc6a6f044a8a2a6f453fde92580cde
SHA512 8fe87b6ed95cd10990282e36e3f0cb4839b99ed2772046ea6ea6ad797710d96b12e5d034779c9939a7833c98b85a17aab3dd24bd57109a012610cab2b493bfed
SSDEEP 49152:U+Ee+Ee+Ee+EVbP+Ee+Ee+EVD+Ee+Ee+Ee+Ee+Ee+EVD+Ee+Ee+Ee+Ee+Ee+EVDE:Xp7C
TLSH
T113972A09FD8640B1E97B51B04DDBD2BF8A30BA2587128EFBF649C71B6933BD05834616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3912	svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe
5968	svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe
3180	svchost_BCACABCABBCACBABBCABCCBABCBAABBBCBAAABCCCBABBBBBACAAAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCABAACBACACBBABCBCAAABCCAACABABCACBCBBCACCCBBACACCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe"	2026-08-10_bc110654618720374baeba20b4b69f09_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBCBACABABAABABCBCACCCCBCCCBCBCAABBCCBBCCBBACBBBACBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACABCABBCACBABBCABCCBABCBAABBBCBAAABCCCBABBBBBACAAAAB.exe"	svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2912	sc.exe
5848	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6000	cmd.exe
4724	cmd.exe
2548	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_bc110654618720374baeba20b4b69f09_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACABCABBCACBABBCABCCBABCBAABBBCBAAABCCCBABBBBBACAAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
632	2026-08-10_bc110654618720374baeba20b4b69f09_elex_stop_vidar.exe
632	2026-08-10_bc110654618720374baeba20b4b69f09_elex_stop_vidar.exe
632	2026-08-10_bc110654618720374baeba20b4b69f09_elex_stop_vidar.exe
632	2026-08-10_bc110654618720374baeba20b4b69f09_elex_stop_vidar.exe
3912	svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe
3912	svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe
3912	svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe
3912	svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	632	2026-08-10_bc110654618720374baeba20b4b69f09_elex_stop_vidar.exe
Token: SeDebugPrivilege	3912	svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 6000	632	2026-08-10_bc110654618720374baeba20b4b69f09_elex_stop_vidar.exe	92
PID 6000 wrote to memory of 992	6000	cmd.exe	94
PID 632 wrote to memory of 4724	632	2026-08-10_bc110654618720374baeba20b4b69f09_elex_stop_vidar.exe	95
PID 4724 wrote to memory of 5848	4724	cmd.exe	97
PID 632 wrote to memory of 2548	632	2026-08-10_bc110654618720374baeba20b4b69f09_elex_stop_vidar.exe	98
PID 2548 wrote to memory of 2912	2548	cmd.exe	100
PID 3912 wrote to memory of 4308	3912	svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_bc110654618720374baeba20b4b69f09_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_bc110654618720374baeba20b4b69f09_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACAAAAAACBAACCACCBCBCCCACCBCBACBCBABBACCCBABACCBBACCCAAABACCCABCACABABBAACBCCAABBBBCCCACCAABBCCCABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACAAAAAACBAACCACCBCBCCCACCBCBACBCBABBACCCBABACCBBACCCAAABACCCABCACABABBAACBCCAABBBBCCCACCAABBCCCABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBAAACBBBCCBABBCAABBCAABBBCBAACBACBBAAABACBBBBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe" start= auto displayName= "UserDataSvc_ABBAAACBBBCCBABBCAABBCAABBBCBAACBACBBAAABACBBBBCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBAAACBBBCCBABBCAABBCAABBBCBAACBACBBAAABACBBBBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe" start= auto displayName= "UserDataSvc_ABBAAACBBBCCBABBCAABBCAABBBCBAACBACBBAAABACBBBBCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBAAACBBBCCBABBCAABBCAABBBCBAACBACBBAAABACBBBBCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBAAACBBBCCBABBCAABBCAABBBCBAACBACBBAAABACBBBBCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe
1⤵
- Executes dropped EXE
PID:5968

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABCABBCACBABBCABCCBABCBAABBBCBAAABCCCBABBBBBACAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABCABBCACBABBCABCCBABCBAABBBCBAAABCCCBABBBBBACAAAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 65edd472f338f4e88ab40c2409618e9ac95a1ddd20ab104b9c20a7b5048d5264
MD5 95b3aabb7d3fa926070c06522e95fcfa
SHA1 6ec68af32e5a09780c4a7fa18498dce7721146eb
SHA512 9c87ac0618ab8cb9a03fd2dc2aab552c61123e1cc001b42274de5cb4f68a9690da7d2019745282d741acfc7f5a112dffba08395c1946ca782cab2db95a2b32b5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 36fd2f216a9d9066b0acf6aefe81ae7f73a1010fb2817c36e8e4673b8e862465
MD5 716f0ce7cd03e4042e37c7df7a7bae63
SHA1 ca30b0eb4ca4dbd7ba623d90ca4fd8010f7cdab0
SHA512 9bc5c9d78dbc2408f530a0bafa6ef314b46ecc564b753f5887b2489d7871d30f97479bdfaa684626eb65ce1b8936f71e80f587816abfaa4dead48005dcaade9b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b4a38598677429cdd07f109501a04800ffbd7c6b8595f1ec32d6e30ccf59b258
MD5 8d3643c13da73e5de54b0e96f01552ff
SHA1 05316f7f97fed51b2d5b0b90644ae392a5eb7a52
SHA512 0162527fa5c1f9a7684f34e27768fb2eee555557a7dc2d6f1b6b225987862b479baf049440747aec1c64260bf6bec5d26c7ee81758ca275fbcf8562caabaf42c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 570d4de49b81929c598c561279ffcfa353b0897fa011e1402f336f500c12db9f
MD5 5b0799c910bde5f871214dc859b2b0ae
SHA1 f4c297a9dd5ef4d4ae6d26cd494251ae520d057b
SHA512 f6af1b601a1314c183239d6ba0478a32c71b58e0c4a30d24e46aa542499559101d4d595a8715ecb70db357c7ade2d942bbb0452dd6a70af14b2f9172c967f18b
MD5 SHA1 SHA512

Submit Download

svchost_BCACABCABBCACBABBCABCCBABCBAABBBCBAAABCCCBABBBBBACAAAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABCABBCACBABBCABCCBABCBAABBBCBAAABCCCBABBBBBACAAAAB.exe
Size 17.6MB
SHA256 84ae4b3365aace6eb18fd1535e6ff925f2180745cfe2b005a570aab96151e4c8
MD5 4d7d4aed87c69a97b8da2f20f5245e1a
SHA1 edf6fb04a9cb9a713674db8806cec5a2f5803cc4
SHA512 378b4488b593417dffc3da824bd30f2b919d8ce273b94963b84f569e526641f106607205a11ea28bf000d5984bf9bf37079bbcfdb6d651e849ca563b00c88c4b
SSDEEP 49152:U+Ee+Ee+Ee+EVbP+Ee+Ee+EVD+Ee+Ee+Ee+Ee+Ee+EVD+Ee+Ee+Ee+Ee+Ee+EVDP:j
TLSH
T176073A09FD8740B1E97B51B04DDBD2BF8A30BA2587128EFBF649C71B6933B905834616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBAAACABCAAAAAACBBBCACCBAABCBBACAAAAABCBBCCBCBAAACBC.exe
Size 38.6MB
SHA256 c9082279ba0695977dec79afb798a148335504f777624201f7ac1e8d1f597595
MD5 bc110654618720374baeba20b4b69f09
SHA1 0f32cf398cdc6a6f044a8a2a6f453fde92580cde
SHA512 8fe87b6ed95cd10990282e36e3f0cb4839b99ed2772046ea6ea6ad797710d96b12e5d034779c9939a7833c98b85a17aab3dd24bd57109a012610cab2b493bfed
SSDEEP 49152:U+Ee+Ee+Ee+EVbP+Ee+Ee+EVD+Ee+Ee+Ee+Ee+Ee+EVD+Ee+Ee+Ee+Ee+Ee+EVDE:Xp7C
TLSH
T113972A09FD8640B1E97B51B04DDBD2BF8A30BA2587128EFBF649C71B6933BD05834616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/632-0-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download

memory/632-7-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download

memory/3912-24-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/3912-37-0x0000000000280000-0x00000000002A1000-memory.dmp

Download