58bd8a04530fdfb34111646ce041fec2ce74caf98859d12b5e6811c1c4ddb573

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 01:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_86e792f10e3e3edab83959f5fae7a5b6_elex_stop_vidar.exe
Size 18.9MB
Sample260811-bjq5tsseqd
SHA256 58bd8a04530fdfb34111646ce041fec2ce74caf98859d12b5e6811c1c4ddb573
MD5 86e792f10e3e3edab83959f5fae7a5b6
SHA1 56cc4e82b6c09f488ee5f5d6cd091b92c6ec4e84
SHA512 64a5eaef35be7f398b60a4809cd8243f9e289aba9bcc59a5c0350483f6c4614347b76b5bf06a925faf152846fbf5b6e48a70a85c5fa7134d8197f89bf2d80da2
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+Eg:hp7f
TLSH
T1D3175B09F94340B1D92B50B04DCBD2BF8A70BA2587128EE7FA4DDB1B7933BE16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4560	svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe
1952	svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe
3844	svchost_ACABBBAACAAAACCABCACABABACAACCCBBBCCBBBAABBCBACABCACBBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABCABBABCCCACBCACACABACCABABCCCBACBCABBBBCBCABAABBABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe"	2026-08-10_86e792f10e3e3edab83959f5fae7a5b6_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCBCBABACCCABCCABBCCCBBAABACBBAACAAACAACBACBCBBCACACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABBBAACAAAACCABCACABABACAACCCBBBCCBBBAABBCBACABCACBBA.exe"	svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2308	sc.exe
2576	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5960	cmd.exe
1120	cmd.exe
3940	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABBBAACAAAACCABCACABABACAACCCBBBCCBBBAABBCBACABCACBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_86e792f10e3e3edab83959f5fae7a5b6_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1152	2026-08-10_86e792f10e3e3edab83959f5fae7a5b6_elex_stop_vidar.exe
1152	2026-08-10_86e792f10e3e3edab83959f5fae7a5b6_elex_stop_vidar.exe
1152	2026-08-10_86e792f10e3e3edab83959f5fae7a5b6_elex_stop_vidar.exe
1152	2026-08-10_86e792f10e3e3edab83959f5fae7a5b6_elex_stop_vidar.exe
4560	svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe
4560	svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe
4560	svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe
4560	svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	2026-08-10_86e792f10e3e3edab83959f5fae7a5b6_elex_stop_vidar.exe
Token: SeDebugPrivilege	4560	svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 5960	1152	2026-08-10_86e792f10e3e3edab83959f5fae7a5b6_elex_stop_vidar.exe	96
PID 5960 wrote to memory of 480	5960	cmd.exe	98
PID 4560 wrote to memory of 5448	4560	svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe	101
PID 1152 wrote to memory of 1120	1152	2026-08-10_86e792f10e3e3edab83959f5fae7a5b6_elex_stop_vidar.exe	102
PID 1120 wrote to memory of 2308	1120	cmd.exe	104
PID 1152 wrote to memory of 3940	1152	2026-08-10_86e792f10e3e3edab83959f5fae7a5b6_elex_stop_vidar.exe	105
PID 3940 wrote to memory of 2576	3940	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_86e792f10e3e3edab83959f5fae7a5b6_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_86e792f10e3e3edab83959f5fae7a5b6_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCAACBCBAAACBBBBABACACABABCCABABCAAACCBCBACACBCCABBCCBBABACABACAACACABCBBCBBCABABBCCBBCCBAACCACBACCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCAACBCBAAACBBBBABACACABABCCABABCAAACCBCBACACBCCABBCCBBABACABACAACACABCBBCBBCABABBCCBBCCBAACCACBACCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCCABCCBCCBBBCCCBACCBBCCBAACCBCBABBBCCBAAABABCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe" start= auto displayName= "UserDataSvc_CACCCABCCBCCBBBCCCBACCBBCCBAACCBCBABBBCCBAAABABCCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCCABCCBCCBBBCCCBACCBBCCBAACCBCBABBBCCBAAABABCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe" start= auto displayName= "UserDataSvc_CACCCABCCBCCBBBCCCBACCBBCCBAACCBCBABBBCCBAAABABCCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCCABCCBCCBBBCCCBACCBBCCBAACCBCBABBBCCBAAABABCCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCCABCCBCCBBBCCCBACCBBCCBAACCBCBABBBCCBAAABABCCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe
1⤵
- Executes dropped EXE
PID:1952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBAACAAAACCABCACABABACAACCCBBBCCBBBAABBCBACABCACBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBAACAAAACCABCACABABACAACCCBBBCCBBBAABBCBACABCACBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LimitMove.exe

Path C:\Users\Admin\Desktop\LimitMove.exe
Size 2.1MB
SHA256 e88e99079b0f2425f844b7a7105b81ba9f155baeb0a97cf79b1bff9d0a6de0f4
MD5 1c448e573148e4332175427b3767d3d2
SHA1 4bb93c7af974e54de14b118f1331eba2cf18ccf7
SHA512 8ff0733c6d0d88cb47b7037172d8bab72b6d214e01fbc6e631111c4eb85742a74320d919faa17a7e1e21a027d38b6eb5d0cbd939ea6b6ee342317bffc2381c6a
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+Eg:z
TLSH
T18AA54A09F94340B1D92B50B04DCBD2BF8A60BB2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cec6215aa5170f1adc6e43afdbf152ad6f628e4edc948ed287991ed14176b528
MD5 af8accf3fa3d2cadfbcfbe3070253914
SHA1 23469809fe6d66bb133527dbe8b7957e1e2de91d
SHA512 8803d2897267388f4a0c8276415c802e93fba78322e2112cd9dbf294d44bed86baa098a9756725709dc2f2b14c06e82bf4f003093207c62b6910d819300a1e9f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3aba190343ab6c9c483111397f89b66b0a5cbc1c42678265bc2b30c2d127d3be
MD5 094ce17a4c87c5ebac6d5cb6ff9cd9cf
SHA1 ef23a7bcc0945a5415ce473aa16156d54e4d1a52
SHA512 b4409c13c91abb4e34722ff34ed82248b105085ecff8ce44bd37c399cba69d7cafd213778ba07cf7d4ea9e2891988fa9bb887abf191468b49396e5a10313988a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e6687e7a3b9519c3392c9f59c56e153659e603cd64ed8f91102741cf27bfc3b8
MD5 590af4f6f2383b0057da1d2caa415de3
SHA1 68262ec1c5bd8a67c4058a5d25a7dd8b6d9c44b0
SHA512 95da004c3f22d4c95ff9e3815c895940d480e1cf952b8a45486a825c9ffe4cf8c0e65ef55a91f092bdf769d27f1a8e2f36e530f8bdfad452049be62f6d64787e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b0da039f82d2b27d0838868bdcd4b90a76f056e1a38e2273e8ce69b33597432a
MD5 447bf90691c20ea551c9d7ee6f2465d3
SHA1 0b8c16b8a9377965f2c74bfaabf47c072600b782
SHA512 c33ca8ac011fa900fc3996d7cd69934e7ce7e0e083de0061be737a0f4bfc6c6d4a18a3cdb485b6cc55df8fb61be8b9fa9fd1df0e2930ea5407f20f64b4198d1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f53f02e5cfe182aabeb76a8a61923db22aaadb8323418f6cf9329540a19d5329
MD5 5972371d1517c68d8572c9f9e4531175
SHA1 5b727c413783670ca71bfe1593fa2e9c808b3afd
SHA512 deaa8d3439a15a57e0dbeb7e2ace078f56427ec8dc3ac289e50fa3f3b17918076539f35757f34715bbed55da58ad4b8e9db744e0c1b145c2755c6beb752967ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 49de7aeb6f8e88e3fdcd52325931a4f294c390a9057bdba2e0de08fc71c66b93
MD5 01abfa36d9b184762b72ab4726139b06
SHA1 2c7d3297a1c899723474441e902a6051f991e589
SHA512 2120704dc8abf968a1ef590055c9ad230325507a7dc73ba6522bc566e91cc75ac8dcbd7b57f2b816ed228b92c278cc984fdc1f76c801ef2dc4263ca0500d0df5
MD5 SHA1 SHA512

Submit Download

svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBABABBACBABCACABACCCABABABABABBCAABBBCBCCBBCBBBABAC.exe
Size 18.9MB
SHA256 58bd8a04530fdfb34111646ce041fec2ce74caf98859d12b5e6811c1c4ddb573
MD5 86e792f10e3e3edab83959f5fae7a5b6
SHA1 56cc4e82b6c09f488ee5f5d6cd091b92c6ec4e84
SHA512 64a5eaef35be7f398b60a4809cd8243f9e289aba9bcc59a5c0350483f6c4614347b76b5bf06a925faf152846fbf5b6e48a70a85c5fa7134d8197f89bf2d80da2
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+Eg:hp7f
TLSH
T1D3175B09F94340B1D92B50B04DCBD2BF8A70BA2587128EE7FA4DDB1B7933BE16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-56-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/1152-61-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/1152-33-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/1152-0-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/1152-22-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/1152-11-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/4560-52-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/4560-34-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/4560-73-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download