f26e38d6f7d18485df4e5f48da6f7549fda179f08151c5940693f06be2447690

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_4e44421c593d139fb2d2d2091002498b_elex_stop_vidar.exe
Size 9.1MB
Sample260811-dsqlrsvbrd
SHA256 f26e38d6f7d18485df4e5f48da6f7549fda179f08151c5940693f06be2447690
MD5 4e44421c593d139fb2d2d2091002498b
SHA1 25a33118fb5be14334fea708392927066f2cc894
SHA512 9e47c83b271449449c6d7f5ebf9297bed83cd04131064c9c743c78b02f3ea4322e66fe4cf04c639d7ac6b8ec7087d3759ccff19ee699db3f7a8e58f13ce99708
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7Lp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7k:vBBBBBBBBJBBBBBBBBk
TLSH
T138A68C10B7818035F5B328728ABFD739552CB9714F6986CFE388072E5E71AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
764	svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe
5776	svchost_BAABCAACCBBBACBCBAACCBBABAACCBBCCABACCBBABAAAACBCBCBBCA.exe
4796	svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCBCACCACCBACBBBACBBAABCBABCBACACCABCBBBCBCABCCBCBAACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe"	2026-08-11_4e44421c593d139fb2d2d2091002498b_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABAABBCCBACCCBCBCCABAABBABCACCCBCABBBCACCBACABCACBABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABCAACCBBBACBCBAACCBBABAACCBBCCABACCBBABAAAACBCBCBBCA.exe"	svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1896	sc.exe
5052	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3848	cmd.exe
3880	cmd.exe
4152	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_4e44421c593d139fb2d2d2091002498b_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABCAACCBBBACBCBAACCBBABAACCBBCCABACCBBABAAAACBCBCBBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2956	2026-08-11_4e44421c593d139fb2d2d2091002498b_elex_stop_vidar.exe
2956	2026-08-11_4e44421c593d139fb2d2d2091002498b_elex_stop_vidar.exe
2956	2026-08-11_4e44421c593d139fb2d2d2091002498b_elex_stop_vidar.exe
2956	2026-08-11_4e44421c593d139fb2d2d2091002498b_elex_stop_vidar.exe
764	svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe
764	svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe
764	svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe
764	svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe
5776	svchost_BAABCAACCBBBACBCBAACCBBABAACCBBCCABACCBBABAAAACBCBCBBCA.exe
5776	svchost_BAABCAACCBBBACBCBAACCBBABAACCBBCCABACCBBABAAAACBCBCBBCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	2026-08-11_4e44421c593d139fb2d2d2091002498b_elex_stop_vidar.exe
Token: SeDebugPrivilege	764	svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe
Token: SeDebugPrivilege	5776	svchost_BAABCAACCBBBACBCBAACCBBABAACCBBCCABACCBBABAAAACBCBCBBCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3848	2956	2026-08-11_4e44421c593d139fb2d2d2091002498b_elex_stop_vidar.exe	92
PID 3848 wrote to memory of 5408	3848	cmd.exe	94
PID 764 wrote to memory of 6108	764	svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe	95
PID 2956 wrote to memory of 3880	2956	2026-08-11_4e44421c593d139fb2d2d2091002498b_elex_stop_vidar.exe	98
PID 3880 wrote to memory of 1896	3880	cmd.exe	100
PID 2956 wrote to memory of 4152	2956	2026-08-11_4e44421c593d139fb2d2d2091002498b_elex_stop_vidar.exe	101
PID 4152 wrote to memory of 5052	4152	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-11_4e44421c593d139fb2d2d2091002498b_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_4e44421c593d139fb2d2d2091002498b_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABBACACAACBAAAACABCCBBBCCACACBBCCBCCABCACAAABCABCBAACBAABCABCBCBCBBCABBACBCCABABCCAABBACBABBBBCCCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABBACACAACBAAAACABCCBBBCCACACBBCCBCCABCACAAABCABCBAACBAABCABCBCBCBBCABBACBCCABABCCAABBACBABBBBCCCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBAABCACCBABBBACCCCBCAACBBCBCCCAAABBACBBCCCCCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe" start= auto displayName= "UserDataSvc_AABBAABCACCBABBBACCCCBCAACBBCBCCCAAABBACBBCCCCCCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBAABCACCBABBBACCCCBCAACBBCBCCCAAABBACBBCCCCCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe" start= auto displayName= "UserDataSvc_AABBAABCACCBABBBACCCCBCAACBBCBCCCAAABBACBBCCCCCCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBAABCACCBABBBACCCCBCAACBBCBCCCAAABBACBBCCCCCCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBAABCACCBABBBACCCCBCAACBBCBCCCAAABBACBBCCCCCCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCAACCBBBACBCBAACCBBABAACCBBCCABACCBBABAAAACBCBCBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCAACCBBBACBCBAACCBBABAACCBBCCABACCBBABAAAACBCBCBBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe
1⤵
- Executes dropped EXE
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c5fd4e8cfe64803aa8804123f291ae13ab4105b52da8e5e98ecc5d7daf549d16
MD5 fe340fae6910d00c28a56e3af5e95dad
SHA1 a567bd50f423be2c38b84aaf58490e56de8564ab
SHA512 3f07fb8a564ac2eb7758aa73c6263ed2ac1bfb5e1d6247b1bd4802d699ca18b32fe0a0a640e73fab32789bd567b5a57a6ae3902deb1377cad6038a470efc25e4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 147a7254d9c435ea1b399e51a47f9a2de3f088fa1852ad63ffa51e316239bdac
MD5 46d6eaf62167ee48e659f07fdf0a790d
SHA1 6df44d5823c92151a6baccfd44482050c2118e81
SHA512 932fb1b77e3237e5bdb64a35da9bc47f794484cbd91046c07dd7de8ea3a6019f425ff4e9ee9a64729be708f934c496a78431fea14c89be9ac4d2e30744680714
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6bbcec278f1493c12ee047d4937840b40faee1953a1caa91d3ece97cd1b90ab9
MD5 11a0c699d079fd20edd8fef54a8b0bda
SHA1 f70493d51ced74f3ef7c53983698dd6bc9846f9e
SHA512 b7f8d906a4e717244e4f8f4540a5a1e838b3a8a253611522279eb01f1e69c0fe8bed6b044fcaa97d14096ffccfbc81a5690c873d997816de93b90c56135fc326
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 af433caa5a8f29023845ff27a26782bd8008e778fc9a988bbaf31a2907c99391
MD5 455ea596994dcc2324ff8fd4b2e5ddbb
SHA1 f5be4e771fe560d906a4707f5f45bff03eae860b
SHA512 7c763fec5c17088e3602f418f3fb37f0b29d1d06aea0fe235ad1cd97f4ef47db1ae5176de4fb472e85d1b1c8796e38371ca291022f0d5cc7ab12f3e8690506ac
MD5 SHA1 SHA512

Submit Download

CloseGroup.exe

Path C:\Users\Admin\Downloads\CloseGroup.exe
Size 27.6MB
SHA256 a925996d90fc34d6b6a2b50614a5b6cbd97394e0ec52f2a5f728451f86b9a4a9
MD5 c9d04a48acfb02a54613d34964999e37
SHA1 4c0b08e1195634d6e73d171308358ab0bb2ae257
SHA512 b699d0993198ea747834532af9ff0e5f289e5fc3b58edcd4e76a0becc3be4f702808ab4d69bd703993b1181e1741cb0f436673440b2f2d7fa7caf1f853c16867
SSDEEP 196608:vBBBBBBBBJBBBBBBBB2BBBBBBBBJBBBBBBBB2BBBBBBBBJBBBBBBBBZ:d
TLSH
T10C578C10B7818035F5B328728ABFD739552CB9714F6986CFE388072E5E71AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseGroup.exe

Path C:\Users\Admin\Downloads\CloseGroup.exe
Size 1.9MB
SHA256 397fe5fc0bb3887c60ea3ebf81bfe4e8f236438deeaaeed8857790a8e802bb65
MD5 4f5caa36f5e15addd95f4a8cca6a535a
SHA1 2e6208b343c6da03a4d1dfb2a9d3643de696eb28
SHA512 a796e4872c12c87ce782e4fa44c0b56f752ab04a7971ea8fb3997486e2d667d8c4f9536e56dc00ae16b2f4d09dbef0bbf72cfb2c30a8187daebe411671f75f35
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WQ:Jp7Dp7Dp7Dp7l
TLSH
T17C957C10B7818035F5B329728ABFD739552CB9714F6986CFE388072E5E70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5ed4258fbee5d31cccbb9ce9e4752a49293db7452a6c1b7e161df180ed8db422
MD5 1f4bb3a07b67327adbb69bbdb516a659
SHA1 50ec1866a40be43a9e62d56ac952aba09366ad4a
SHA512 34fb32feaf2e5f019ba55eb6df4667daa3fbfa0e2e4d28ec164738121aab47d60666e89e4d67f92379e1237949c645e031f74b701ee9840cc4d9f5085089c7f2
MD5 SHA1 SHA512

Submit Download

svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBCBCCAABCAABBACBCCCBACAABABAABACBCCBCCABCCACAABCA.exe
Size 9.1MB
SHA256 f26e38d6f7d18485df4e5f48da6f7549fda179f08151c5940693f06be2447690
MD5 4e44421c593d139fb2d2d2091002498b
SHA1 25a33118fb5be14334fea708392927066f2cc894
SHA512 9e47c83b271449449c6d7f5ebf9297bed83cd04131064c9c743c78b02f3ea4322e66fe4cf04c639d7ac6b8ec7087d3759ccff19ee699db3f7a8e58f13ce99708
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7Lp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7k:vBBBBBBBBJBBBBBBBBk
TLSH
T138A68C10B7818035F5B328728ABFD739552CB9714F6986CFE388072E5E71AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d3fd924d93fec88cc105868f70b1f92ba967f996804412778f7b3c9d194620d6
MD5 a4d06dc1a7167983e759d882847ae4fc
SHA1 e98a16bfd5cdd84fbd992d6ca8922ab2b1ebaa9c
SHA512 367ae1346e54721ecceb700ea65ca1fff49b492d0d5af4e74f5c4d824855085518d5a443599433400e3223b5b0f6ef8b0ae5ed0a4855a0560d37c9de9d18e692
TLSH
T1C211C151D4E5D867BD337CCBD43B8A830CE026EB58287B6563194118BB89C334E190F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/764-34-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/764-49-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/764-71-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/2956-33-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/2956-59-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/2956-0-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/2956-85-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/2956-22-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/2956-11-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/4796-107-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/5776-104-0x0000000000540000-0x0000000000561000-memory.dmp

Download